Review desired state and drift
Record a versioned baseline, compare observed drift, stage canaries and rings, and assign unresolved work.
TenantVigil only reads your Microsoft 365 tenant. It never changes a setting: you apply each fix yourself.
Need a hands-on starting point?
Start with one tenant or talk to the team if you want help evaluating fit, permissions, or rollout approach.
Record the baseline
Baseline templates are API-only. A partner admin creates and versions them through the session-authenticated POST /api/msp/baseline-templates route and explicitly reviews customer assignments; there is no template editor in the portal. The template is immutable once created, so a drift comparison has a fixed reference.
A baseline is your intended configuration. It is not an automatic repair policy.
Compare observed drift
TenantVigil compares observed settings with the baseline and checks safety conflicts before deployment. Unknown inputs stay unknown.
The comparison is a review step. It does not change a customer tenant by itself.
Stage canaries and rings
Preview deployment rings and apply supported report-only administrator-MFA canaries through each customer's Microsoft approval when live writes are enabled.
Ordinary Conditional Access state, security defaults and Intune selections stay manual. A preview stays visibly a preview; Nothing is sent to Microsoft is shown for a preview stage.
Own the follow-up
Drift links to owned service work and reports. Later scans can keep the line from a verified canary deployment through its plan, receipt and owned case.
TenantVigil does not promise to repair every drifted setting automatically. Each change still needs its own plan, safety checks and approval.
Next action
Prepare the customer report, or plan the next change.
- Prepare a customer service report
- Plan a change and read its receipt