Know the moment your Microsoft 365 security settings change.
NebulaCore snapshots Entra ID, Conditional Access, Intune, Defender for Business and Exchange Online every hour. When a setting drifts from your approved baseline, you get an alert and can roll it back in one click.
- Drift
- Baselines
- History
- Rollbacks
- Alerts
Drift since baseline v14
demo-tenant.onmicrosoft.com
- Settings tracked
- 1,284
- 6 workloads
- Drifted
- 4
- Last 24 hours
- High risk
- 1
- Needs approval
Open drift
| Setting | Detected | Severity |
|---|---|---|
| Require MFA for admins Conditional Access · state: enabled → disabled | 09:14 | High |
| Global Administrator added Role assignment · 1 new member | 08:02 | Review |
| Windows 11 compliance policy Intune · BitLocker required → not required | Yesterday | Review |
| External auto-forwarding Exchange Online · outbound spam policy | Yesterday | Accepted |
Three things your admin center does not show you.
Require MFA for admins · versions
| Version | Changed by | State |
|---|---|---|
| v16 | helpdesk-02 | Disabled |
| v15 | it-admin | Enabled |
| v14 | Baseline | Enabled |
Every version, kept. Each policy has its own history: who changed it, when, and the exact JSON before and after.
- Drift detected on Require MFA for admins 09:14
- Security lead approved rollback to v15 09:21
- Restored and verified by new snapshot 09:22
Rollback with a named approver. Restoring a setting takes one click, and nobody restores alone.
One status per workload. See at a glance which parts of the tenant still match the baseline you signed off on.
Running in under an hour.
- 01
Connect your tenant
A Global Administrator consents to the NebulaCore app in Microsoft Entra ID. The default grant is read-only Microsoft Graph access to policy and configuration objects. No mailbox or file content is requested.
- 02
Capture your baseline
The first snapshot runs within 15 minutes and becomes version 1 of your baseline. Review it, mark settings you care about as protected, and approve it.
- 03
Route alerts and approvers
Send drift alerts to Microsoft Teams, Slack, email or a webhook. Name who can approve a rollback. Write access for rollback is a separate, optional consent you can revoke at any time.
How we handle your tenant.
We hold a copy of your security configuration. That copy deserves the same care as the settings themselves.
Read-only by default
Write permission for rollback is a separate consent. Revoke it in Entra ID and NebulaCore keeps monitoring.
No content, only config
We never request mail, chat or file scopes. Snapshots contain policy objects and role assignments.
Encrypted end to end
TLS 1.2 or higher in transit, AES-256 at rest, with a separate encryption key per tenant.
Export and delete
Download every snapshot as JSON at any time. Data is deleted 30 days after you cancel.
Questions IT teams ask
Which Microsoft 365 licenses do I need?
Snapshots work on any tenant with Microsoft Entra ID. Conditional Access and Intune coverage need the licenses that include those features, such as Microsoft 365 Business Premium, E3 or E5. We only read settings your tenant already has.
Does NebulaCore read our email or documents?
No. We read configuration objects through Microsoft Graph: policies, role assignments, compliance rules, transport rules and sharing settings. Message bodies, attachments and files are never requested or stored.
What does a rollback actually do?
It writes the previous approved version of that one setting back to your tenant through Microsoft Graph, then takes a fresh snapshot to confirm the result. Every rollback needs a named approver and is recorded in the activity log.
Can someone change settings through NebulaCore itself?
Only by restoring a prior version that already existed in your tenant. NebulaCore does not offer a free-form policy editor, so it cannot be used to create new access rules.
How quickly will we see a change?
On the Business plan, snapshots run every hour, so a change shows up within 60 minutes. On the Team plan, snapshots run daily. Enterprise tenants can request 15-minute intervals.
What happens to our data if we cancel?
You can export every snapshot as JSON before you leave. Thirty days after cancellation we delete your snapshots, alert history and audit log from our systems.
See what changed in your tenant this week.
14-day trial on the Business plan. No credit card. Your first baseline is ready within 15 minutes of consent.