Entra Policy Suite settings · Settings > Tamper monitor
Restore foreign changes automatically
| Key | TamperMonitor.AutoRestore |
|---|---|
| Where | Settings > Tamper monitor |
| Type | On / off |
| Default | Off |
| Feature | Tamper monitor · Community |
| Confirmation | Entra Policy Suite asks you to confirm before it is switched on. |
What it does
Whether the monitor puts the engine's value back by itself after every foreign change it finds, instead of waiting for an admin to choose Accept or Restore.
When enabled
Straight after the alert, in the same run, each open event is restored and the restore is in the audit trail as made by 'auto-restore'.
When disabled
Off (the default): events stay Open until an admin accepts or restores them on the Tamper page.
Risk and how to reverse it
A legitimate writer that is not on the allow list gets its change undone at every monitor run, and the value flips back and forth. Reversible: switch it off; values already restored stay.
Requires
Admin. 'Tamper monitor' switched on.
Recommended
Off until the allow list holds every legitimate writer; then on for a strict tenant.
Documented for Entra Policy Suite 2.0.107. Written by the Entra Policy Suite team; Invardia publishes it. · All settings · Security review pack