Drift & events

Unbacked-changes detection and the change events feed.

How drift detection works

Every backup is compared to the previous snapshot, object by object. Runtime noise (timestamps, internal ids, server-managed fields) is excluded, so a detected change means real configuration changed, not API churn.

Events

Each detected change becomes an event: add, update, or delete, with the object type, its name, and (for updates) which fields changed. Each tenant's Activity page is the change history of that IdP, filterable by change type. Events appear from the second backup onward, because a diff needs two snapshots. Users & Access backups feed the same lane: user, membership, and assignment changes appear as events alongside config changes, and each Users & Access snapshot's changes summary is clickable for a full compare with field-level values.

Unbacked changes

Between backups, IdPVault polls each provider's own event log to count configuration changes that have happened since your last snapshot; that's the Unbacked config changes stat on the all-tenants dashboard and on each tenant's Overview strip - click it there to open the Changes page. It's a count (the detail comes from the next backup's diff), and it's your cue to run a backup if something unexpected is moving. When changes are pending, a Backup config now button appears right on the card.

Tenants with Users & Access backup enabled get a second card, Unbacked Users & Access changes: users, group memberships, and app assignments changed since the latest Users & Access snapshot, with its own Backup Users & Access now button when something is pending. Because user data is the rate-limited part of every provider's API, this check runs on the slower cadence set by Live State users cache in System settings (default 60 minutes) rather than the config interval, and it skips the provider entirely when a recent Users & Access backup already captured current state. Refresh Users from provider on the Live State panel refreshes this card immediately.

The Changes page

Each tenant's Changes page compares any two points in time: pick a From backup and a To point - another backup, or Current (the live provider configuration). You get totals, per-category filter chips, and every added, removed, and changed object with its changed fields and full before/after JSON. Restore… on a removed or changed object restores it from the From backup via the usual dry-run preview. By default it answers "what changed since my last backup"; step back through history when you need "what changed between then and now".

Why this matters

The drift lane is your unauthorized-change detector: if an admin (or an attacker) modifies a policy, removes an app, or weakens MFA rules, the next backup catches it, the event records it, and the alert tells you, with the change list in the message.