🛡️ EasyTCM

Stop Microsoft 365 tenant drift before it becomes a breach.

Someone changes a Conditional Access policy. A transport rule gets modified. An auth method is disabled. You don't know until something breaks — or fails an audit.

Microsoft's new TCM APIs monitor your tenant configuration server-side every 6 hours across Entra, Exchange, Intune, Teams, and Security & Compliance.

EasyTCM makes them accessible through 3 simple commands.

Install-Module EasyTCM

# 1. Setup (one time — guided wizard handles everything)
Start-TCMMonitoring

# 2. Check for drift (daily)
Show-TCMDrift

# 3. After approved changes, accept the new state
Update-TCMBaseline

Start-TCMMonitoring — Guided wizard: connects to Graph, creates the TCM service principal, snapshots your tenant, builds a security-focused baseline, creates a monitor. Zero to monitoring in one run.

Show-TCMDrift — Your daily command:

Show-TCMDrift                    # quick console summary
Show-TCMDrift -Report            # HTML dashboard with admin portal links
Show-TCMDrift -Maester           # pipe results into Maester test framework
Show-TCMDrift -CompareBaseline   # also catch new/deleted resources

Update-TCMBaseline — After you verify drift is from approved changes, rebaseline with one command. Shows current drift for review, takes fresh snapshot, updates the monitor.

Console drift check:

🔍 Checking for configuration drift...

  ⚠️  3 active drift(s) detected!

  conditionalaccesspolicy (2):
    • Block Legacy Auth — 1 changed property
      state: enabled → disabled
    • Require MFA for Admins — 1 changed property
      excludeUsers: [] → ["breakglass@contoso.com"]

  namedlocation (1):
    • Corporate Network — 1 changed property
      ipRanges: ["10.0.0.0/8"] → ["10.0.0.0/8","192.168.0.0/16"]

Maester integration — drift as failed tests in your existing report:

Scope your TCM monitor to only the resource types that matter for CISA compliance. When a CISA-relevant config changes, you'll know within 6 hours.

# Create a CISA-scoped monitor in one pipeline
New-TCMSnapshot -Wait | ConvertTo-TCMBaseline -Template CISA-SCuBA-Entra -DisplayName 'CISA Entra' | New-TCMMonitor

# Or combine all three workloads
$snap = New-TCMSnapshot -Workload Entra, Exchange, Teams -Wait
ConvertTo-TCMBaseline -SnapshotContent $snap -Template CISA-SCuBA-Entra, CISA-SCuBA-Exchange, CISA-SCuBA-Teams

EasyTCM watches the config. Maester/ScubaGear checks the rules. Use Show-TCMDrift -Maester to pipe TCM drift into Maester's test framework for unified reporting.

Three built-in templates cover 41 CISA SCuBA controls across 23 TCM resource types:

Need to add or remove resource types from your monitor? No need to rebuild from scratch:

# Visual editor — opens in your browser
Edit-TCMMonitor

# Or inspect what you're monitoring
Show-TCMMonitor -Browser

Use preset buttons (SecurityCritical / Recommended / Full) or select resource types with checkboxes, then click Copy PowerShell Command and paste. EasyTCM handles the snapshot, baseline merge, and monitor update.

# Non-interactive — scripted updates
Edit-TCMMonitor -ResourceTypes @('microsoft.entra.conditionalaccesspolicy','microsoft.entra.authenticationmethodpolicy')

# Expand coverage with a CISA template — no rebaselining needed
Add-TCMMonitorType -Template CISA-SCuBA-Exchange

Install-Module EasyTCM -Scope CurrentUser

Two ready-to-use workflow templates live in templates/workflows/:

# Add to your repo — that's it.
# Runs daily at 06:00 UTC and on manual trigger.
on:
  schedule:
    - cron: '0 6 * * *'
  workflow_dispatch:

Drift = failing Pester test = workflow failure = free alerting via GitHub notifications.

See the full setup guide for app registration, permissions, OIDC vs client-secret auth, and troubleshooting.

6 workloads, 62 resource types: Entra (CA policies, auth methods, named locations) · Exchange (transport rules, anti-phishing, DKIM) · Intune (device config) · Teams (meeting/messaging policies, federation) · Security & Compliance (DLP, retention, sensitivity labels)

Compliance templates: 3 CISA SCuBA baselines (Entra, Exchange, Teams) scope your monitors to security-relevant resource types. See templates/.

git clone https://github.com/kayasax/EasyTCM.git
cd EasyTCM; Import-Module ./EasyTCM/EasyTCM.psd1; Invoke-Pester ./tests/

See CONTRIBUTING.md for guidelines.

Built with ❤️ for the Microsoft 365 Administrator Community
By the creator of EasyPIM