{"id":1854,"date":"2026-04-05T22:48:34","date_gmt":"2026-04-05T22:48:34","guid":{"rendered":"https:\/\/move2modern.uk\/?p=1854"},"modified":"2026-04-06T07:59:45","modified_gmt":"2026-04-06T07:59:45","slug":"move-aside-utcm-is-here-or-is-it","status":"publish","type":"post","link":"https:\/\/move2modern.uk\/index.php\/2026\/04\/05\/move-aside-utcm-is-here-or-is-it\/","title":{"rendered":"Move aside, UTCM is here! Or is it?"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

Drift Management with Microsoft\u2019s Unified Tenant Configuration Management<\/strong> (UTCM)<\/strong><\/p>\n\n\n\n

PART 2 OF 2<\/strong><\/p>\n\n\n\n

\n\n\n\n

Important Note: <\/strong><\/p>\n\n\n\n

Results captured for this blog are from my own hands-on testing only. UTCM is in public preview with a staged rollout. Your results may differ, and things may change before becoming GA.<\/em><\/p>\n\n\n\n

<\/div>\n\n\n\n

If you\u2019ve come from Part 1 of this blog series, you hopefully have an insight into what configuration drift actually is and the DIY approaches available already. I first introduced the ideas for using PowerShell scripts, Power Apps, Automate flows and direct Graph API calls as alternative routes for drift management. These have been used used by many existing tools and solutions for some time now. For my own tool IntuneAutomate I also originally looked at the drift-detection functionality. It has to be said though that using what some regard as the a DIY approach like this can introduce maintenance hurdles, particularly when there\u2019s a Microsoft upgrade, updates to an API endpoint or maybe even the renaming to a property.<\/p>\n\n\n\n

<\/div>\n\n\n\n

That’s exactly the problem Microsoft’s Unified Tenant Configuration Management<\/strong> (UTCM) has been designed to solve and why getting to know the capability better became top of mind despite it still being in preview and pending license and pricing announcements.<\/p>\n\n\n\n

<\/div>\n\n\n\n

UTCM if effectively a native, platform-level solution to the drift detection problem and includes automation built-in. When it was first announced I was immediately interested and after having had some time to try it out, I wanted to bring the details and results from my own testing into this blog. Two things were key targets for me – I wanted to identify how it works, essentially the mechanics of it and then confirm the current status or limitations to features.<\/p>\n\n\n\n

<\/div>\n\n\n\n

The short answer by the way (as of the start April 2026) is that UTCM can work cleanly for Conditional Access (CA) and Intune resource types (RT)- Although it did take lots of trial an error to prove this with Intune RTs. In order to reach my conclusions, I spent several weeks testing across two tenants, experiencing numerous hurdles along the way. I’m talking dead ends, drained monthly quotas (on the first day of the month) incorrect UTCM API calls with mistakes from undocumented routes. This post looks to cover all of that – what UTCM is, how to deploy it, what I found, and what it means for your planning today.<\/p>\n\n\n\n

Preview Notice<\/strong>
UTCM is still a staged public preview as of April 2026. All findings in this post reflect personal testing from my own andy@move2modern.co.uk and other commercial tenant during March\u2013April 2026. Results will vary by tenant depending on preview ring assignment. What works or fails here may behave differently in your environment.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Sovereign cloud note<\/strong>
UTCM APIs are Global service only. They are not available in US Government L4\/L5 (DoD) or the China cloud operated by 21Vianet. Verify your own endpoint availability before investing time in setup.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Section 1 \u2022 What Is UTCM and Where Did It Come From?<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

A Different Kind of Monitoring<\/h1>\n\n\n\n
\n\n\n\n

A Different Kind of Monitoring<\/strong><\/p>\n\n\n\n

Part 1 of this series was about device-level drift and asking<\/strong>: Are my devices in the right state? Compliance, policy assignment, configuration profile application.<\/p>\n\n\n\n

UTCM asks a different but related question:<\/strong> Are my Microsoft 365 tenant configurations in the right state? Not the devices. If someone quietly changes a CA policy, alters an Exchange transport rule, or deletes a compliance policy baseline from your tenant, UTCM is designed to detect that. Think of it as version control for your tenant settings, which is exactly what I needed.<\/p>\n\n\n\n

The M365DSC Connection<\/h2>\n\n\n\n

M365DSC Led the way: <\/strong> Microsoft 365 Desired State Configuration (M365DSC), an open-source PowerShell project that has existed since 2019, led the way for this concept covering the M365 ecosystem. UTCM will effectively be Microsoft’s officially-supported, Graph API-native successor to this, where solutions shift from PowerShell DSC modules to JSON baselines and REST endpoints. Key to note here is that Nik Charlebois<\/em>, the Principal Program Manager behind UTCM, was also the original creator of M365DSC making it clear that UTCM is the evolution of that work into the product platform.<\/p>\n\n\n\n

<\/div>\n\n\n\n

The Three<\/strong> Core Concepts<\/strong><\/p>\n\n\n\n

What It Does<\/strong><\/td>Key Constraint<\/strong><\/td><\/tr><\/thead>
Point-in-time capture of current tenant configuration for one or more resource types. This becomes your baseline.<\/td>Expires after 7 days \u2013 Recommended to export locally immediately.<\/td><\/tr>
Runs every 6 hours and compares live tenants against your stored snapshot baseline.<\/td>6-hour interval is fixed and not configurable in preview.<\/td><\/tr>
When live state differs from baseline, a drift event is created with the old value, new value, and resource details.<\/td>No automated remediation in preview – just detection only at this stage.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Where UTCM Lives in Microsoft’s Stack<\/h2>\n\n\n\n

UTCM capabilities are exposed through Microsoft Graph (beta endpoint currently, with some core endpoints also available at v1.0). Microsoft Entra Tenant Governance also has a new UI feature in preview available in the Entra admin centre. Thiis provides capability for viewing permissions and monitors with run history, and drift results without any API calls. There is no equivalent UI at this point though in the Intune admin centre:<\/p>\n\n\n\n

Tenant Governance \u2192 Configuration management<\/strong><\/p>\n\n\n\n

REALLY key to note here is that UTCM is not an Intune only feature. In preview, UTCM is designed to cover six Microsoft 365 workloads, although coverage and maturity does vary by workload, at least with my own testing:<\/p>\n\n\n\n