- Configuration management tools at a glance
- Eleven configuration management tools to try
- Secure configuration is a security control
- Agent or agentless?
- Questions to ask before you standardise
- Signs your servers are drifting
- My plain advice on choosing configuration management tools
- Frequently asked questions
The best configuration management tools describe how every server should look in code, apply that state automatically and report any drift: small teams often prefer agentless tools that are quick to learn, while large fleets need agents, reporting and vendor support. Eleven options follow in no particular order.
Every server starts out tidy. Then someone changes a setting by hand to fix an urgent problem, another person installs a package for a test, and six months later no two machines are quite alike.
Configuration management tools stop that drift by keeping systems in a known, written-down state. The eleven tools below are listed alphabetically and in no particular order, and every description comes from the vendor's or project's own site, read this week. If you're also hiring for this kind of work, see my guide to finding remote DevOps talent.
Configuration management tools at a glance
In the free plan column, Yes means the tool's own site names a free plan, a free version, a free edition or open-source code. Trial only means a time-limited trial. Not stated means the pages I read named neither, even where there's a button inviting you to try it.
| Tool | Type | Good for | Free plan |
|---|---|---|---|
| Ansible | Agentless automation platform | Teams wanting simple YAML playbooks | Trial only |
| CFEngine | Lightweight configuration management | Huge fleets needing a light agent | Not stated |
| Chef | Infrastructure and compliance automation | Policy as code at enterprise scale | Trial only |
| Juju | Orchestration engine for operators | Deploying and running apps on Ubuntu | Not stated |
| Microsoft Configuration Manager | Device configuration and deployment | Windows estates managed on-premises | Not stated |
| NixOS | Reproducible system configuration | Identical, reproducible machine builds | Not stated |
| Otter | Server provisioning and configuration | Windows-friendly teams avoiding heavy scripting | Not stated |
| Puppet | Infrastructure automation | Large, regulated server estates | Not stated |
| pyinfra | Agentless infrastructure automation in Python | Developers who prefer plain code | Yes |
| Rudder | Configuration and security compliance | Hardening and compliance reporting | Yes |
| Salt | Open-source automation framework | Remote execution across many machines | Yes |
Eleven configuration management tools to try
Ansible
Best for: Teams that want agentless automation written in readable playbooks, with Red Hat's supported platform for larger rollouts.
CFEngine
Best for: Organisations running very large fleets that want a long-standing, lightweight agent to keep systems compliant and healthy.
Chef
Best for: Enterprises that want infrastructure and compliance described as code and applied consistently at scale.
Juju
Best for: Teams in the Canonical and Ubuntu world that want to deploy and run applications with operators instead of scripts.
Microsoft Configuration Manager
Best for: Windows-heavy organisations that manage devices, software and settings from on-premises infrastructure, often alongside Intune.
NixOS
Best for: Engineers who want whole systems defined in code so every build and deployment can be reproduced exactly.
Otter
Best for: Windows-leaning teams that want to provision servers and manage configuration from a visual tool rather than scripts alone.
Puppet
Best for: Large organisations that want infrastructure kept in a desired state at scale, with vendor-backed support from Perforce.
pyinfra
Best for: Developers who would rather describe server changes in plain Python than learn a new configuration language.
Rudder
Best for: Security-minded operations teams that want configuration management tied to security posture, hardening and compliance reports, with an open-source project.
Salt
Best for: Engineers who want one open-source framework for both remote execution and configuration management across many machines.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Secure configuration is a security control
The NCSC lists secure configuration as one of the five technical controls in its Cyber Essentials scheme, describing it as setting up computers securely to minimise the ways a cyber criminal can find a way in.
That makes configuration management a security tool as much as an operations one. A good setup can prove every server has the same hardened settings, and flag the one that someone quietly changed.
Agent or agentless?
Agentless tools connect over SSH or a similar channel when you run them, so there's nothing to install on each machine and they're quick to start with. Agent-based tools run a small program on every server that checks in on a schedule, which suits large fleets and continuous enforcement.
Neither is better in every case. Small teams often start agentless, and larger estates often move to agents for reporting and scale. It's also worth checking how each tool handles secrets such as passwords and keys, because configuration code that holds them in plain text creates a new problem while it solves the old one. If you're not sure, ask to see how a vendor's own documentation stores them.
Questions to ask before you standardise
- Which operating systems and cloud platforms do you support?
- How does the tool detect and report drift?
- Can our engineers read and review changes as code?
- Is there a supported version as well as the open-source one?
- How does it fit with our infrastructure as code tools?
- What happens if a change fails halfway through a fleet?
Signs your servers are drifting
- No two servers match. Fixes work on one and fail on the next.
- Rebuilds take days. Nobody remembers every setting.
- Changes happen by hand. There's no record of who did what.
- Audits mean screenshots. You can't prove settings from code.
Do you make configuration management tools? Tool makers can ask to be considered for a featured place on this list.
My plain advice on choosing configuration management tools
Pick the tool your team will happily write and review, because configuration management only works if changes go through it rather than around it. A tool nobody likes becomes shelfware while hand fixes carry on.
Then start with one useful baseline, such as your security hardening settings, and roll it out everywhere before you tackle the clever stuff. If repetitive admin work is the wider problem, my roundup of workflow automation tools covers the business side.
Frequently asked questions
What is configuration management?
It's the practice of defining how systems should be set up, applying that setup automatically and keeping track of any changes or drift.
What is configuration drift?
Drift is when a system's real settings slowly move away from the intended setup, usually through manual changes or one-off fixes.
Is configuration management the same as infrastructure as code?
They overlap. Infrastructure as code usually creates cloud resources, while configuration management sets up and maintains what runs on them.
Are there free configuration management tools?
Yes. Several open-source tools are free to use, and some vendors sell supported versions on top.
What does agentless mean?
It means the tool connects to machines when needed instead of running a permanent program on each one.
Do small teams need configuration management?
Even a handful of servers benefits from having settings written down as code, so they can be rebuilt quickly and checked for drift.
