# Choose Machine Configuration drift behavior explicitly

> Separate a one-time application followed by monitoring from automatic correction on later evaluations.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:29:02+00:00
- Modified: 2026-09-10T00:55:36+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Separate a one-time application followed by monitoring from automatic correction on later evaluations.

## Potentially affected

Azure Machine Configuration assignments that apply guest configuration.

## DSE recommendation

Approve the assignment's drift behavior with the workload owner before enabling corrective configuration.

## Article

## Source facts

ApplyAndMonitor applies the configuration and subsequently reports noncompliance without automatically correcting drift unless remediation is triggered. ApplyAndAutoCorrect instead corrects drift during the next evaluation. Audit reports the machine’s state without making the configuration change.

For existing noncompliant machines in ApplyAndAutoCorrect mode, Microsoft distinguishes the initial remediation task from the agent’s later ongoing correction of drift. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/concepts/remediation-options).

## Applicability

Identify the supported guest configuration, assignment type, enforcement setting, and existing-machine onboarding state. Review who else can change the same guest settings and whether automatic reversal would conflict with an approved operational action.

## DSE recommendation

DSE recommends choosing the drift response as a workload decision rather than accepting a default. Record which deviations should be observed for investigation and which should be corrected automatically. Obtain approval for the initial application separately from continuing enforcement, and preserve the previous configuration and authorized exception process.

## Verification

On an approved test machine, apply the intended configuration and then introduce a harmless controlled deviation. Observe whether the assignment reports or corrects it as designed. Check the actual guest setting alongside compliance status, and repeat after an approved remediation trigger where relevant. Retain the assignment and observations before widening scope.

## Official references

[Microsoft Learn: Remediation options for machine configuration](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/concepts/remediation-options). Source retrieved September 9, 2026.

## Primary reference

- Name: Remediation options for machine configuration - Azure Machine Configuration | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/machine-configuration/concepts/remediation-options
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose Machine Configuration drift behavior explicitly,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-174-choose-machine-configuration-drift-behavior-explicitly/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.