Choose Machine Configuration drift behavior explicitly

Source facts

ApplyAndMonitor applies the configuration and subsequently reports noncompliance without automatically correcting drift unless remediation is triggered. ApplyAndAutoCorrect instead corrects drift during the next evaluation. Audit reports the machine’s state without making the configuration change.

For existing noncompliant machines in ApplyAndAutoCorrect mode, Microsoft distinguishes the initial remediation task from the agent’s later ongoing correction of drift. Microsoft Learn.

Applicability

Identify the supported guest configuration, assignment type, enforcement setting, and existing-machine onboarding state. Review who else can change the same guest settings and whether automatic reversal would conflict with an approved operational action.

DSE recommendation

DSE recommends choosing the drift response as a workload decision rather than accepting a default. Record which deviations should be observed for investigation and which should be corrected automatically. Obtain approval for the initial application separately from continuing enforcement, and preserve the previous configuration and authorized exception process.

Verification

On an approved test machine, apply the intended configuration and then introduce a harmless controlled deviation. Observe whether the assignment reports or corrects it as designed. Check the actual guest setting alongside compliance status, and repeat after an approved remediation trigger where relevant. Retain the assignment and observations before widening scope.

Official references

Microsoft Learn: Remediation options for machine configuration. Source retrieved September 9, 2026.