# Step 11 -- Snapshots and Drift (Later)

## Goal

Know what changed after deployment and retain useful historical
configuration.

## Model

``` text
Desired state = Git/Bicep + parameters
Observed state = Azure/Sentinel inventory
Comparison = drift
```

## First Evaluate Existing Tools

Before writing custom drift tooling, evaluate Microsoft/native and
established community GitOps/Sentinel-as-code projects. Avoid recreating
a mature capability.

## If Custom Inventory Is Needed

Normalize volatile fields such as timestamps, etags, provisioning
metadata, generated IDs where appropriate, and array ordering before
comparison.

## Drift Types

-   Approved/customer exception
-   Unapproved portal drift
-   Platform-version drift

## Snapshot Candidates

Workspace settings, retention, DCR/DCE, connectors, analytics,
automation, workbooks, playbooks, RBAC, identities, diagnostic settings,
and relevant solution/content state.

## Decisions

Snapshot frequency, storage location, sensitive metadata policy,
alerting method, remediation vs PR/review, and customer-managed snapshot
process.