Azure Deployment Drift Detector

Overview

This flow catches unmanaged changes (drift) to the Azure estate. Each day it enumerates every resource currently deployed in the target subscription via Azure Resource Manager (ARM) and compares that *actual* state to an *expected* baseline stored in Dataverse. Resources present in Azure but not in the baseline are flagged Added (ClickOps / unmanaged), and baseline resources no longer deployed are flagged Removed (deletions). Every finding is written to a Dataverse drift-log table, a scorecard is posted to a Teams channel, and a daily drift report is emailed via Outlook.

Why it matters: Resources created or deleted outside IaC cause configuration drift, security gaps, and cost surprises. A daily diff against intended state surfaces those changes so they can be reconciled or reverted.

> Build status: Built via API-first (workflow-table) deployment. Flow ships Off. Going live requires only: (1) authorize the Teams/Dataverse/Outlook connections, (2) set the Azure credential env vars (tenant/client/secret/subscription) for an SP with Reader on the subscription, (3) seed the baseline table, (4) turn the flow on.

Use Case

A platform team running infrastructure-as-code wants to know when the live Azure environment diverges from the intended baseline — new resources, deletions, or configuration changes — without manually auditing the portal.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Microsoft Dataverse	shared_commondataserviceforapps	ListRecords CreateRecord
Microsoft Teams	shared_teams	PostMessageToConversation
Office 365 Outlook	shared_office365	SendEmailV2

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Git baseline

Read the expected inventory from a repo (state file / manifest) via the GitHub/GitLab connector instead of (or in addition to) Dataverse.

Configuration drift

Extend beyond add/remove to compare per-resource properties (SKU, tags, location) by hashing the ARM resource object and storing the hash in the baseline; flag mismatches as a third Changed drift type.

Auto-revert

Gate an Approvals step, then remove unmanaged additions on approval.

Change correlation

Join drift to the Azure Activity Log actor who made the change.

Scope

Sweep multiple subscriptions / management groups by looping over a subscription list env var.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@not(contains(body('Select_Baseline_Ids'), toLower(item()?['id'])))

@not(contains(body('Select_Deployed_Ids'), toLower(item()?['flowlibs_resourceid'])))

@{concat(variables('varArmBase'),'/subscriptions/',variables('varSubscriptionId'),'/resources?api-version=',variables('varArmApiVersion'))}

@{concat(variables('varArmBase'),'/')}

@{guid()}

Customize & download