Implementing a configuration management strategy
Implement a configuration management strategy
Drift is the problem being solved
Configuration written once and never re-asserted decays: someone RDPs in, a hotfix changes a setting, an image ages. A configuration management strategy is a loop, not a deployment:
Machine Configuration supports both auditing (report what is non-compliant) and remediation (converge it back). Starting in audit-only mode is the safe rollout: you learn what is already non-compliant before anything is changed under a running service.
Immutable versus mutable
| Approach | Handling drift |
|---|---|
| Mutable — converge existing machines | Configuration management converges drift |
| Immutable — rebuild from a golden image | Drift cannot accumulate; replace rather than repair |
Immutable infrastructure sidesteps drift entirely and pairs naturally with containers and scale sets. Mutable is unavoidable where machines are long-lived, stateful or physical.
Secrets never live in the definition
Configuration is in source control, so secrets belong in Key Vault, referenced at apply time — via a Key Vault-linked variable group or a managed identity. A password in a configuration file is a password in git history.
Primary sources