Before-and-after values
Compare each collected directory state with the previous retained snapshot to expose attribute, membership, policy, and configuration changes.
Entra ID change monitoring
See what changed in Microsoft Entra ID before context disappears
Monitor directory changes across identities and access configuration, compare retained object snapshots, and give investigators the old and new values they need without reconstructing events by hand.
Five-minute collection
Connected tenants are polled on a five-minute schedule, with a manual Poll now control for administrators who need an immediate refresh.
Adaptive change bursts
Learn each tenant's normal activity by hour so unusual volumes stand out without treating expected morning and overnight automation as identical.
Context beyond a single audit event
An individual Microsoft Graph audit record does not always include every previous value required to explain a change. IAMCastle therefore maintains a tenant-scoped local representation of supported Entra objects and compares the latest state with the previous captured state.
The resulting evidence can identify changes to names, account status, user attributes, group membership, application configuration, and Conditional Access settings. Resolved display names are retained alongside source identifiers so the evidence remains understandable even when an object is later renamed or removed.
Collection assurance records connector health, successful polls, failures, and recovery. Administrators can see when evidence was last collected and receive notification when repeated failures threaten continuity.