Compliance Drift Detector

<#
.SYNOPSIS
    Compliance-Drift-Detector - Detects configuration drift in compliance policies.

.DESCRIPTION
    <!-- library-status:start -->
    Prüfstatus: Ungeprüft
    Aus dem bestehenden GitHub-Bestand übernommen; fachliche und Tenant-Abnahme ausstehend.

    <!-- library-status:end -->

    Compares the current state of a target compliance policy against a
    defined 'Golden Image' to identify unauthorized or accidental changes.
#>

[CmdletBinding()]
param (
    [Parameter(Mandatory=$true)]
    [string]$GoldenPolicyId,

    [Parameter(Mandatory=$true)]
    [string]$TargetPolicyId
)

process {
    Write-Host "[INFO] Analyzing compliance drift..." -ForegroundColor Cyan

    $Golden = Get-MgDeviceManagementCompliancePolicy -DeviceId $GoldenPolicyId
    $Target = Get-MgDeviceManagementCompliancePolicy -DeviceId $TargetPolicyId

    $Drift = @()

    # Simplified comparison of key properties
    if ($Golden.Settings -ne $Target.Settings) {
        $Drift += "Settings mismatch detected between Golden Policy and Target Policy."
    }

    if ($Drift) {
        $Drift | ForEach-Object { Write-Host "[DRIFT] $_" -ForegroundColor Red }
    } else {
        Write-Host "[SUCCESS] No configuration drift detected." -ForegroundColor Green
    }
}