Microsoft Entra ID GovernanceCreate a configuration monitor
In brief
Learn how to create a configuration monitor in Microsoft Entra Tenant Governance to evaluate a tenant against a configuration baseline and report drift
What Entra admins need to know
Review the documentation change to determine whether it affects tenant configuration, security posture, or rollout plans.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
Open on Microsoft Learn ↗The comparison below is an extract of the Microsoft Learn article showing only the changed content. Open the full article for complete context.
Create and update a configuration monitor
This article describes how to create and updateConfiguration monitors evaluate a configuration monitor in the Microsoft Entra admin center. A configuration monitor periodically evaluates your tenant configuration against a configuration baseline. It recordsbaseline and report configuration driftsdrift. Use a monitor when the actual state differs from the desired state.you want to track whether a tenant stays aligned with a known-good configuration.
Before you beginPrerequisites
Sign in to the Microsoft Entra admin center as at least a Global Administrator.Verify that yourThe tenant has licenses for Tenant Governance Basic or Tenant Governance Premium. For current licensing requirements, see Microsoft Entra Tenant Governance licensing.- Tenant Governance Basic includes a quota for the number of resources that you can monitor. If the resources in the monitor cause the tenant to exceed its quota, monitor creation fails. An organization gets additional quota for monitored resources for each Tenant Governance Premium license
forit has. - The signed-in user is in a Microsoft Entra
Tenant Governance. Verify that youprivileged role and has permission to create configuration monitors. The user must also havethe required Microsoft Graph applicationread permissions for the resource types included inyourthe monitor's configuration baseline.
Create a configuration monitor
Use these steps to create a new configuration monitor.
Step 1: Permissions
On the Permissions page, review the Microsoft Graph application permissions required to evaluate the resource types definedincluded in the configurationmonitor baseline. AddTo assign or remove permissions as needed, then grant all required permissions before you proceed.
Select Next to continue.
Step 2: Configuration baseline
On the Configuration baseline page, write, paste, or upload the JSON file that defines the desired configuration state for the resources you want to monitor. The JSON includes the configuration baseline and elements that define the display name and description of the monitor. Theservice, see Configure configuration management service permissions.
Start monitor evaluates this baseline each time it runs.
After you validate the baseline, select Next.
Step 3: Review
On the Review page, confirm the monitor name, description, and configuration baseline. Verify that the resource count matches what you intend.
Select Create monitor to create the configuration monitor.
Update an existing configuration monitorcreation
To update an existingstart creating a configuration monitor:monitor, follow these steps:
- Sign in to the Microsoft Entra admin center as a user with the required role and permissions.
- Browse to Tenant Governance >
Configuration management>Monitors. FindSelect New.
Complete the monitor you wantwizard
Complete the wizard steps to updateconfigure and selectcreate the edit (pencil) icon next to its name.monitor:
On Settings, enter a unique monitor name of at least eight characters and an optional description.
The update wizard uses the same steps as creating a monitor: Permissions →On Configuration baseline →, upload a baseline JSON file or select ReviewImport from snapshot. If you select Import from snapshot, search by snapshot name, select a snapshot, and then select Import. You can use the in-page editor to manually compose or edit the configuration baseline.
On Permissions, review whether the service has permission to:
- Read the required Microsoft Graph resources, to monitor Microsoft Entra or Intune resources.
- Authenticate to Exchange, to monitor Exchange, Defender, or Purview resources.
- Use the Teams Reader role, to monitor Teams resources.
- On Review, review the summary and create the monitor.
After you create the monitor, it runs automatically on a periodic schedule. Monitor results are available after the monitor runs for the first time, between zero and six hours after creation.
To learn how to review monitor results and configuration drift, see View monitor results and manage monitors
.When you update an existing configuration monitor, the updated settings replace the existing monitor definition.
Next steps
Related content
@@ -1,69 +1,57 @@ ----title: Create a monitor+title: Create a configuration monitor titleSuffix: Microsoft Entra ID Governance-description: Learn how to create and configure a tenant configuration monitor in Microsoft Entra Tenant Governance to track configuration drift+description: Learn how to create a configuration monitor in Microsoft Entra Tenant Governance to evaluate a tenant against a configuration baseline and report drift ms.topic: how-to-ms.date: 03/10/2026+ms.date: 07/28/2026 --- -<!-- source: Create_and_Update_Configuration_Monitor_LearnStyle.docx -->+<!-- source: Tenant Governance - Create a new configuration monitor how-to.docx --> -# Create and update a configuration monitor+# Create a configuration monitor -This article describes how to create and update a configuration monitor in the [Microsoft Entra admin center](https://entra.microsoft.com). A configuration monitor periodically evaluates your tenant configuration against a configuration baseline. It records configuration drifts when the actual state differs from the desired state.+Configuration monitors evaluate a tenant against a configuration baseline and report configuration drift. Use a monitor when you want to track whether a tenant stays aligned with a known-good configuration. -## Before you begin+## Prerequisites -1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Global Administrator](~/identity/role-based-access-control/permissions-reference.md#global-administrator).+- The tenant has licenses for **Tenant Governance Basic** or **Tenant Governance Premium**. For current licensing requirements, see [Microsoft Entra Tenant Governance licensing](licensing.md).+- Tenant Governance Basic includes a quota for the number of resources that you can monitor. If the resources in the monitor cause the tenant to exceed its quota, monitor creation fails. An organization gets additional quota for monitored resources for each Tenant Governance Premium license it has.+- The signed-in user is in a Microsoft Entra privileged role and has permission to create configuration monitors. The user must also have read permissions for the resource types included in the monitor's configuration baseline.+- The Tenant Configuration Management service has permissions for the workloads and resource types included in the monitor baseline. To assign or remove permissions for the service, see [Configure configuration management service permissions](how-to-set-up-permissions-tenant-monitoring.md). -1. Verify that your tenant has a license for Microsoft Entra Tenant Governance.+## Start monitor creation -1. Verify that you have the required Microsoft Graph application permissions for the resource types included in your configuration baseline.+To start creating a configuration monitor, follow these steps: -> [!TIP]-> Although you can author a configuration baseline directly in the wizard, in most scenarios it's easiest to prepare the baseline before you start monitor creation. One approach is to copy the baseline from an existing monitor. To learn more, see [Configuration management](configuration-management.md).+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a user with the required role and permissions.+1. Browse to **Tenant Governance** > **Monitors**.+1. Select **New**. -## Create a configuration monitor+## Complete the monitor wizard -Use these steps to create a new configuration monitor. The monitor creation wizard guides you through **Permissions**, **Configuration baseline**, and **Review**.+Complete the wizard steps to configure and create the monitor: -### Step 1: Permissions+1. On **Settings**, enter a unique monitor name of at least eight characters and an optional description.+1. On **Configuration baseline**, upload a baseline JSON file or select **Import from snapshot**. If you select **Import from snapshot**, search by snapshot name, select a snapshot, and then select **Import**. You can use the in-page editor to manually compose or edit the configuration baseline.+1. On **Permissions**, review whether the service has permission to: -On the **Permissions** page, review the Microsoft Graph application permissions required to evaluate the resource types defined in the configuration baseline. Add or remove permissions as needed, then grant all required permissions before you proceed.+ - Read the required Microsoft Graph resources, to monitor Microsoft Entra or Intune resources.+ - Authenticate to Exchange, to monitor Exchange, Defender, or Purview resources.+ - Use the **Teams Reader** role, to monitor Teams resources. -Select **Next** to continue.+ > [!NOTE]+ > This step doesn't evaluate whether the user is authorized to create a monitor with the selected resources. It also doesn't show or validate whether the permissions assigned to the configuration management service locally within Exchange Online, Defender, or Purview are sufficient to create a monitor with resources in those services. -### Step 2: Configuration baseline+1. On **Review**, review the summary and create the monitor. -On the **Configuration baseline** page, write, paste, or upload the JSON file that defines the desired configuration state for the resources you want to monitor. The JSON includes the configuration baseline and elements that define the display name and description of the monitor. The monitor evaluates this baseline each time it runs.+After you create the monitor, it runs automatically on a periodic schedule. Monitor results are available after the monitor runs for the first time, between zero and six hours after creation. -After you validate the baseline, select **Next**.+To learn how to review monitor results and configuration drift, see [View monitor results and manage monitors](how-to-see-monitor-results.md). -### Step 3: Review--On the **Review** page, confirm the monitor name, description, and configuration baseline. Verify that the resource count matches what you intend.--Select **Create monitor** to create the configuration monitor.--## Update an existing configuration monitor--To update an existing configuration monitor:--1. Browse to **Tenant Governance** > **Configuration management** > **Monitors**.-1. Find the monitor you want to update and select the edit (pencil) icon next to its name.--The update wizard uses the same steps as creating a monitor: **Permissions** → **Configuration baseline** → **Review**.--When you update an existing configuration monitor, the updated settings replace the existing monitor definition.--> [!IMPORTANT]-> When you change an existing monitor, Tenant Governance automatically deletes all previously generated monitor results and configuration drifts. The updated monitor records results and configuration drifts again each time it runs.->-> After you create or update a monitor, you might need to wait up to six hours for the monitor to run. After the monitor runs, view monitor results and configuration drifts.--## Next steps+## Related content - [Configuration management](configuration-management.md)-- [See monitor results and configuration drifts](how-to-see-monitor-results.md)-- [Update or delete a monitor](how-to-update-delete-monitor.md)-- [Set up permissions for tenant monitoring](how-to-set-up-permissions-tenant-monitoring.md)+- [configurationMonitor](/graph/api/resources/configurationmonitor?view=graph-rest-1.0&preserve-view=true)+- [configurationBaseline](/graph/api/resources/configurationbaseline?view=graph-rest-1.0&preserve-view=true)+- [Configure configuration management service permissions](how-to-set-up-permissions-tenant-monitoring.md)+- [Create configuration snapshots](how-to-create-snapshots.md)