How to synchronize admin settings across multiple O365 tenants

We are still spinning up O365 for the organization, and in doing so, we've decided to have a production tenant, and a sand-box tenant (minimally).  However, we are worried about drift over time in terms of what admin rights/functions get set in one vs the other one.  

Are there any recommended tools that can a) evaluate O365 tenants from a settings level, and be able to allow for comparison with other tenants, and b) do the equivalent of a merge from one tenant to another one (i.e. make the sandbox tenant look exactly like production in terms of settings, etc).