MicrosoftMicrosoftBeing able to change one setting with Set-AzsSecurity and keep drift control on for everything else is a real step up from switching it all off. One question from the incident side: does drift control keep a record of when a setting changed and when it was put back. If an attacker loosens a setting on a host and it gets reverted later, that time helps tell how far back the host may have been touched. That is what you need before choosing a recommended recovery point for the VMs on it.
Disclosure: I work at CyberSnap.
MicrosoftThanks for the question. Yes, both kinds of change leave a record in the local event logs.
Changes made through Set-AzsSecurity are logged in the Microsoft-OSConfig/Operational log (event 1001). Each entry records the setting, the new value, who made the change and when.
Changes made outside the supported path, which drift control detects and reverts, are logged in the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin log. Each entry records when the drift was detected and which setting was corrected.
As a best practice for auditing and investigations, forward both logs to your local SIEM or Cloud SIEM such Azure Monitor.
