{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/", "slug": "dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly", "url": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/" }, "title": "Choose Machine Configuration drift behavior explicitly", "summary": "Separate a one-time application followed by monitoring from automatic correction on later evaluations.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:02+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 207, "potentially_affected": "Azure Machine Configuration assignments that apply guest configuration.", "dse_recommendation": "Approve the assignment's drift behavior with the workload owner before enabling corrective configuration.", "primary_source": { "name": "Remediation options for machine configuration - Azure Machine Configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/machine-configuration/concepts/remediation-options", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

ApplyAndMonitor applies the configuration and subsequently reports noncompliance without automatically correcting drift unless remediation is triggered. ApplyAndAutoCorrect instead corrects drift during the next evaluation. Audit reports the machine’s state without making the configuration change.

\n

For existing noncompliant machines in ApplyAndAutoCorrect mode, Microsoft distinguishes the initial remediation task from the agent’s later ongoing correction of drift. Microsoft Learn.

\n

Applicability

\n

Identify the supported guest configuration, assignment type, enforcement setting, and existing-machine onboarding state. Review who else can change the same guest settings and whether automatic reversal would conflict with an approved operational action.

\n

DSE recommendation

\n

DSE recommends choosing the drift response as a workload decision rather than accepting a default. Record which deviations should be observed for investigation and which should be corrected automatically. Obtain approval for the initial application separately from continuing enforcement, and preserve the previous configuration and authorized exception process.

\n

Verification

\n

On an approved test machine, apply the intended configuration and then introduce a harmless controlled deviation. Observe whether the assignment reports or corrects it as designed. Check the actual guest setting alongside compliance status, and repeat after an approved remediation trigger where relevant. Retain the assignment and observations before widening scope.

\n

Official references

\n

Microsoft Learn: Remediation options for machine configuration. Source retrieved September 9, 2026.

", "content_text": "Source facts\nApplyAndMonitor applies the configuration and subsequently reports noncompliance without automatically correcting drift unless remediation is triggered. ApplyAndAutoCorrect instead corrects drift during the next evaluation. Audit reports the machine’s state without making the configuration change.\nFor existing noncompliant machines in ApplyAndAutoCorrect mode, Microsoft distinguishes the initial remediation task from the agent’s later ongoing correction of drift. Microsoft Learn.\nApplicability\nIdentify the supported guest configuration, assignment type, enforcement setting, and existing-machine onboarding state. Review who else can change the same guest settings and whether automatic reversal would conflict with an approved operational action.\nDSE recommendation\nDSE recommends choosing the drift response as a workload decision rather than accepting a default. Record which deviations should be observed for investigation and which should be corrected automatically. Obtain approval for the initial application separately from continuing enforcement, and preserve the previous configuration and authorized exception process.\nVerification\nOn an approved test machine, apply the intended configuration and then introduce a harmless controlled deviation. Observe whether the assignment reports or corrects it as designed. Check the actual guest setting alongside compliance status, and repeat after an approved remediation trigger where relevant. Retain the assignment and observations before widening scope.\nOfficial references\nMicrosoft Learn: Remediation options for machine configuration. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nApplyAndMonitor applies the configuration and subsequently reports noncompliance without automatically correcting drift unless remediation is triggered. ApplyAndAutoCorrect instead corrects drift during the next evaluation. Audit reports the machine’s state without making the configuration change.\n\nFor existing noncompliant machines in ApplyAndAutoCorrect mode, Microsoft distinguishes the initial remediation task from the agent’s later ongoing correction of drift. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/concepts/remediation-options).\n\n## Applicability\n\nIdentify the supported guest configuration, assignment type, enforcement setting, and existing-machine onboarding state. Review who else can change the same guest settings and whether automatic reversal would conflict with an approved operational action.\n\n## DSE recommendation\n\nDSE recommends choosing the drift response as a workload decision rather than accepting a default. Record which deviations should be observed for investigation and which should be corrected automatically. Obtain approval for the initial application separately from continuing enforcement, and preserve the previous configuration and authorized exception process.\n\n## Verification\n\nOn an approved test machine, apply the intended configuration and then introduce a harmless controlled deviation. Observe whether the assignment reports or corrects it as designed. Check the actual guest setting alongside compliance status, and repeat after an approved remediation trigger where relevant. Retain the assignment and observations before widening scope.\n\n## Official references\n\n[Microsoft Learn: Remediation options for machine configuration](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/concepts/remediation-options). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/", "url": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose Machine Configuration drift behavior explicitly", "item": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/", "url": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/", "headline": "Choose Machine Configuration drift behavior explicitly", "description": "Separate a one-time application followed by monitoring from automatic correction on later evaluations.", "abstract": "Separate a one-time application followed by monitoring from automatic correction on later evaluations.", "articleBody": "Source facts\nApplyAndMonitor applies the configuration and subsequently reports noncompliance without automatically correcting drift unless remediation is triggered. ApplyAndAutoCorrect instead corrects drift during the next evaluation. Audit reports the machine’s state without making the configuration change.\nFor existing noncompliant machines in ApplyAndAutoCorrect mode, Microsoft distinguishes the initial remediation task from the agent’s later ongoing correction of drift. Microsoft Learn.\nApplicability\nIdentify the supported guest configuration, assignment type, enforcement setting, and existing-machine onboarding state. Review who else can change the same guest settings and whether automatic reversal would conflict with an approved operational action.\nDSE recommendation\nDSE recommends choosing the drift response as a workload decision rather than accepting a default. Record which deviations should be observed for investigation and which should be corrected automatically. Obtain approval for the initial application separately from continuing enforcement, and preserve the previous configuration and authorized exception process.\nVerification\nOn an approved test machine, apply the intended configuration and then introduce a harmless controlled deviation. Observe whether the assignment reports or corrects it as designed. Check the actual guest setting alongside compliance status, and repeat after an approved remediation trigger where relevant. Retain the assignment and observations before widening scope.\nOfficial references\nMicrosoft Learn: Remediation options for machine configuration. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:02+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose Machine Configuration drift behavior explicitly" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 207, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Remediation options for machine configuration - Azure Machine Configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/machine-configuration/concepts/remediation-options" } } ] } }