Version control for the settings that keep your tenant secure.
NebulaCore reads your Microsoft 365 configuration through Microsoft Graph, stores each version, compares it with the baseline you approved, and lets you restore any earlier version with an approver on record.
What we track
| Workload | Configuration objects captured |
|---|---|
| Microsoft Entra ID | Role assignments, authentication methods policy, security defaults, app registrations and consent settings, named locations |
| Conditional Access | Every policy: users and groups in scope, cloud apps, conditions, grant controls, session controls, report-only state |
| Microsoft Intune | Device compliance policies, configuration profiles, BitLocker and FileVault settings, app protection policies |
| Defender for Business | Attack surface reduction rules, tamper protection, antivirus and EDR settings, onboarding status per platform |
| Exchange Online | Transport rules, outbound spam and auto-forwarding policy, anti-phishing policy, DKIM signing state |
| SharePoint and OneDrive | External sharing level, default link type, guest access expiry, sync restrictions |
Snapshots and history
Snapshots run hourly on Business and daily on Team. Only settings that changed create a new version, so history stays readable. Open any version to see a field-by-field diff and the Entra ID audit entry that names who made the change.
- Drift
- Baselines
- History
- Rollbacks
Windows 11 compliance
Intune
Versions
| Version | Field changed | Change |
|---|---|---|
| v9 | bitLockerEnabled | true → false |
| v8 | osMinimumVersion | 10.0.22631 |
| v7 | passwordMinimumLength | 8 → 12 |
| v6 | Baseline approved | Baseline |
- Open drift
- 3
- 1 high severity
- Median time to review
- 22 min
- Last 30 days
- Baseline match
- 99.7%
- 1,280 of 1,284
Drift detection and alerts
Each snapshot is compared with the approved baseline. Changes are scored High, Review or Info using rules you can edit: a disabled Conditional Access policy or a new Global Administrator is High by default. Alerts go to a Microsoft Teams channel, Slack, email or any HTTPS webhook.
Approvals and rollback
Every drift item moves through a short review. Accept it and it becomes part of the next baseline. Roll it back and NebulaCore writes the previous version through Microsoft Graph, then snapshots again to confirm. The person who requests a rollback cannot approve it.
Detected1
-
Require MFA for admins disabled
High Conditional Access
Under review2
-
Global Administrator added
Review Entra ID · requested by IT admin -
BitLocker no longer required
Review Intune
Rolled back1
-
Guest link expiry removed
Verified SharePoint · restored v4
Accepted1
-
Auto-forwarding to partner domain
Baseline Exchange Online · added to baseline
Baselines, reports and API
- Starter baselines. Begin from your current tenant or a recommended baseline for Microsoft 365 Business Premium, then adjust.
- Monthly reports. PDF and CSV summaries of every change, who approved it and the current baseline match, ready for your auditor or leadership.
- REST API. Pull drift items and snapshots into your SIEM or ticketing tool with a scoped API token.
list-open-drift.sh
curl https://api.nebulacore.buzz/v1/tenants/{tenantId}/drift?status=open \
-H "Authorization: Bearer $NEBULACORE_TOKEN"
{
"data": [{
"id": "drf_8Q2k",
"workload": "conditionalAccess",
"setting": "Require MFA for admins",
"field": "state",
"baseline": "enabled",
"current": "disabled",
"severity": "high",
"detectedAt": "2026-10-27T16:14:03Z"
}]
}