diff --git a/acquia_contenthub.services.yml b/acquia_contenthub.services.yml
index c49f1a7..941872d 100644
--- a/acquia_contenthub.services.yml
+++ b/acquia_contenthub.services.yml
@@ -147,6 +147,11 @@ services:
     tags:
       - { name: event_subscriber }
 
+  entity.config_id.cdf.attribute:
+    class: Drupal\acquia_contenthub\EventSubscriber\CdfAttributes\ConfigEntityIdAttribute
+    tags:
+      - { name: event_subscriber }
+
   entity_id_and_revision.field.cdf.serializer:
     class: Drupal\acquia_contenthub\EventSubscriber\SerializeContentField\RemoveIdAndRevisionFieldSerialization
     tags:
diff --git a/modules/acquia_contenthub_noconfig/README.md b/modules/acquia_contenthub_noconfig/README.md
new file mode 100644
index 0000000..47e8317
--- /dev/null
+++ b/modules/acquia_contenthub_noconfig/README.md
@@ -0,0 +1,25 @@
+# Acquia ContentHub No Config
+
+This module prevents Acquia ContentHub from creating or updating config entities on subscribers. It can be used to manage config differences between a publisher and subscribers.
+
+When this module is enabled on a subscriber site, and a ContentHub import contains new config entities, the import will be halted before any items are created or updated on the subscriber. 
+
+When a Content Hub import is halted, you will see an error level log entry like this:
+
+> Content Hub import failed: new config with uuid de6af3ca-700e-42c5-a97b-6f34c157b511 (node_type profile)
+
+This log entry will report the first piece of new config encountered; there may be more new config later in the import which will not be reached, since this error halts the process.
+
+## Allowing and logging config creation
+
+This module can also allow Acquia ContentHub to create new config on a subscriber as part of an import, but prevent existing config from being updated.
+
+To enable config creation, run:
+
+```
+drush config:set acquia_contenthub_noconfig.settings allow_create_config true
+```
+
+When a new config entity is imported, you will see a warning level log entry like this:
+
+> Content Hub created new config with uuid de6af3ca-700e-42c5-a97b-6f34c157b511 (node_type profile)
diff --git a/modules/acquia_contenthub_noconfig/acquia_contenthub_noconfig.info.yml b/modules/acquia_contenthub_noconfig/acquia_contenthub_noconfig.info.yml
new file mode 100644
index 0000000..cc94792
--- /dev/null
+++ b/modules/acquia_contenthub_noconfig/acquia_contenthub_noconfig.info.yml
@@ -0,0 +1,6 @@
+name: Acquia ContentHub No Config
+type: module
+description: Allows subscribers to prevent Acquia ContentHub from creating or updating config.
+core: 8.x
+dependencies:
+  - acquia_contenthub_subscriber
diff --git a/modules/acquia_contenthub_noconfig/acquia_contenthub_noconfig.services.yml b/modules/acquia_contenthub_noconfig/acquia_contenthub_noconfig.services.yml
new file mode 100644
index 0000000..5e7abb5
--- /dev/null
+++ b/modules/acquia_contenthub_noconfig/acquia_contenthub_noconfig.services.yml
@@ -0,0 +1,6 @@
+services:
+  acquia_contenthub_noconfig.remove_config_entities:
+    class: Drupal\acquia_contenthub_noconfig\EventSubscriber\EntityDataTamper\ConfigEntities
+    arguments: ['@acquia_contenthub_subscriber.tracker', '@event_dispatcher']
+    tags:
+      - { name: event_subscriber }
diff --git a/modules/acquia_contenthub_noconfig/config/install/acquia_contenthub_noconfig.settings.yml b/modules/acquia_contenthub_noconfig/config/install/acquia_contenthub_noconfig.settings.yml
new file mode 100644
index 0000000..ed61f6f
--- /dev/null
+++ b/modules/acquia_contenthub_noconfig/config/install/acquia_contenthub_noconfig.settings.yml
@@ -0,0 +1 @@
+allow_create_config: false
diff --git a/modules/acquia_contenthub_noconfig/config/schema/acquia_contenthub_noconfig.schema.yml b/modules/acquia_contenthub_noconfig/config/schema/acquia_contenthub_noconfig.schema.yml
new file mode 100644
index 0000000..0c26f11
--- /dev/null
+++ b/modules/acquia_contenthub_noconfig/config/schema/acquia_contenthub_noconfig.schema.yml
@@ -0,0 +1,8 @@
+acquia_contenthub_noconfig.settings:
+  type: config_object
+  label: Acquia ContentHub No Config configuration
+
+  mapping:
+    allow_create_config:
+      type: boolean
+      label: Allow Acquia ContentHub to create config on this site.
diff --git a/modules/acquia_contenthub_noconfig/src/EventSubscriber/EntityDataTamper/ConfigEntities.php b/modules/acquia_contenthub_noconfig/src/EventSubscriber/EntityDataTamper/ConfigEntities.php
new file mode 100644
index 0000000..46dd9e8
--- /dev/null
+++ b/modules/acquia_contenthub_noconfig/src/EventSubscriber/EntityDataTamper/ConfigEntities.php
@@ -0,0 +1,119 @@
+<?php
+
+namespace Drupal\acquia_contenthub_noconfig\EventSubscriber\EntityDataTamper;
+
+use Drupal\acquia_contenthub\AcquiaContentHubEvents;
+use Drupal\acquia_contenthub\Event\EntityDataTamperEvent;
+use Drupal\acquia_contenthub_subscriber\SubscriberTracker;
+use Drupal\acquia_contenthub_noconfig\NewConfigException;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\depcalc\DependentEntityWrapper;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Class RemoveConfigEntities.
+ *
+ * Handle config entities on Content Hub subscriber sites.
+ */
+class ConfigEntities implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * The subscriber tracker.
+   *
+   * @var \Drupal\acquia_contenthub_subscriber\SubscriberTracker
+   */
+  protected $tracker;
+
+  /**
+   * The event dispatcher.
+   *
+   * @var \Symfony\Component\EventDispatcher\EventDispatcherInterface
+   */
+  protected $dispatcher;
+
+  /**
+   * RemoveConfigEntities constructor.
+   *
+   * @param \Drupal\acquia_contenthub_subscriber\SubscriberTracker $tracker
+   *   Subscriber tracker.
+   * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $dispatcher
+   *   Event dispatcher.
+   */
+  public function __construct(SubscriberTracker $tracker, EventDispatcherInterface $dispatcher) {
+    $this->tracker = $tracker;
+    $this->dispatcher = $dispatcher;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents() {
+    $events[AcquiaContentHubEvents::ENTITY_DATA_TAMPER][] = ['onDataTamper', 1001];
+    return $events;
+  }
+
+  /**
+   * Prevent all config entities from being updated.
+   *
+   * @param \Drupal\acquia_contenthub\Event\EntityDataTamperEvent $event
+   *   The data tamper event.
+   *
+   * @throws \Exception
+   */
+  public function onDataTamper(EntityDataTamperEvent $event) {
+    $cdf = $event->getCdf();
+    foreach ($cdf->getEntities() as $object) {
+      if ($object->getType() === "drupal8_config_entity") {
+        $entity_type_attr = $object->getAttribute('entity_type');
+        $id_attr = $object->getAttribute('config_entity_id');
+
+        if ($id_attr && $entity_type_attr) {
+          $entity_type = $entity_type_attr->getValue()['und'];
+          $id = $id_attr->getValue()['und'];
+
+          // Attempt to load an existing entity with the same ID.
+          $existing_entity = \Drupal::entityTypeManager()
+            ->getStorage($entity_type)
+            ->load($id);
+
+          if ($existing_entity) {
+            // Add existing entities to the stack, so that the config from the
+            // CDF does not overwrite the existing config.
+            $wrapper = new DependentEntityWrapper($existing_entity);
+            $wrapper->setRemoteUuid($object->getUuid());
+            $event->getStack()->addDependency($wrapper);
+          }
+          else {
+            // Handle new config entities.
+            $config = \Drupal::config('acquia_contenthub_noconfig.settings');
+
+            // Details for log entries.
+            $context = [
+              '@uuid' => $object->getUuid(),
+              '@type' => $entity_type,
+              '@id' => $id,
+            ];
+
+            if ($config->get('allow_create_config') !== TRUE) {
+              // Prevent new config from being created. This will stop an import
+              // at the first new config entity encountered, before any entities
+              // are created or updated. A warning is logged about the new
+              // config, but there may be additional new config entities later
+              // in the CDF that are not logged.
+              \Drupal::logger('acquia_contenthub_noconfig')->error('Acquia ContentHub import failed on new config (uuid: @uuid, config entity type: @type, id: @id)', $context);
+              throw new NewConfigException($this->t('Acquia ContentHub import failed on new config (uuid: @uuid, config entity type: @type, id: @id)', $context));
+            }
+            else {
+              // Log when new config is created.
+              \Drupal::logger('acquia_contenthub_noconfig')->warning("Acquia ContentHub created new config (uuid: @uuid, config entity type: @type, id: @id)", $context);
+            }
+          }
+        }
+      }
+    }
+  }
+
+}
diff --git a/modules/acquia_contenthub_noconfig/src/NewConfigException.php b/modules/acquia_contenthub_noconfig/src/NewConfigException.php
new file mode 100644
index 0000000..09da693
--- /dev/null
+++ b/modules/acquia_contenthub_noconfig/src/NewConfigException.php
@@ -0,0 +1,12 @@
+<?php
+
+namespace Drupal\acquia_contenthub_noconfig;
+
+/**
+ * Class ConfigImportException.
+ *
+ * Thrown when Acquia ContentHub attempts to create new config.
+ *
+ * @package Drupal\acquia_contenthub_noconfig
+ */
+class NewConfigException extends \Exception {}
diff --git a/src/EventSubscriber/CdfAttributes/ConfigEntityIdAttribute.php b/src/EventSubscriber/CdfAttributes/ConfigEntityIdAttribute.php
new file mode 100644
index 0000000..949a68b
--- /dev/null
+++ b/src/EventSubscriber/CdfAttributes/ConfigEntityIdAttribute.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace Drupal\acquia_contenthub\EventSubscriber\CdfAttributes;
+
+use Acquia\ContentHubClient\CDFAttribute;
+use Drupal\acquia_contenthub\AcquiaContentHubEvents;
+use Drupal\acquia_contenthub\Event\CdfAttributesEvent;
+use Drupal\Core\Config\Entity\ConfigEntityInterface;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Adds the entity ID to config entity CDFs.
+ */
+class ConfigEntityIdAttribute implements EventSubscriberInterface {
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents() {
+    $events = [];
+    $events[AcquiaContentHubEvents::POPULATE_CDF_ATTRIBUTES][] = ['onPopulateAttributes', 100];
+    return $events;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function onPopulateAttributes(CdfAttributesEvent $event) {
+    $entity = $event->getEntity();
+    if ($entity instanceof ConfigEntityInterface) {
+      $cdf = $event->getCdf();
+      $cdf->addAttribute('config_entity_id',CDFAttribute::TYPE_STRING, $entity->id());
+    }
+  }
+
+}