Use this section to compare the current configuration state of your target tenant against a selected baseline and determine what to align.
You cannot start a new deployment while the tenant status is “Pending approval”, “Running deploy”, or “Propagating”. Wait until the current deployment is completed or cleared.
View differences
Select a configuration and click “View” to open its details, including its properties and their values.
The information shown depends on the alignment state:
| Alignment status | What you see |
|---|---|
| Unaccepted deviation | All properties are shown. For properties that are conflicting, both the reference and current values are displayed. Turn on the “Show differences” toggle to highlight the changes in color, or turn it off to view all properties without highlighting. Use the “Select all” buttons to highlight every difference in the list at once. |
| Recommended from baseline | Only the property values from the reference baseline are shown. |
| Aligned | The properties and their current values are shown. |
| Accepted deviation | All properties are shown. For properties that are conflicting, both the reference and current values are displayed. Turn on the “Show differences” toggle to highlight the changes in color, or turn it off to view all properties without highlighting. |
Alignment actions
Alignment actions allow you to bring your tenant's configurations in the same state as the reference baseline.
The available actions depend on the alignment state of the configuration:
Unaccepted deviation
You can conform configurations whose values differ from the reference baseline. Select “Align” to make the current values in line with the reference baseline.
Recommended from baseline
You can align configurations that exist in the reference baseline but are not present in the current state of your tenant. Select “Add” to add the configurations to your tenant.
Accepted deviation
If you are a Configuration Admin or a Tenant Admin, you can mark a configuration deviation from the reference baseline as acceptable when the difference is required for business, technical, or operational reasons:
- Select “Accept deviation” to keep the configuration difference.
- Select “Revoke an accepted deviation” when the justification for the deviation no longer applies. The configuration returns as either “Unaccepted deviation” or “Recommended from baseline”, based on its original status.
Effect on Security Score
Accepted deviations do not reduce the tenant Security score. They let you acknowledge intentional differences from the baseline while continuing to track them.
When the “Unchangeable” label is is displayed, alignment isn’t supported because Microsoft’s APIs don’t allow changes to this configuration. To align it, you must use the Microsoft portal.
Review selected changes and deploy
When you select an alignment action, the change is added to a preview area together with any other pending changes.
Nothing is applied automatically, and no changes are written to the tenant at this stage. Selected changes:
- Stay in the preview area until you confirm them by clicking “Deploy”.
- Are applied to the tenant only after an administrator approves them.
Review property by property
Click the expand icon to open the preview area and see exactly what will change.
Select a Configuration Type from the left sidebar, then select a configuration to review its changes at property level. Each property value is marked to show the requested change:
- Adding: the value that will be added.
- Removing: the value that will be removed.
- Changing: the current value, shown as “Old value”, and the new value, shown as “New value”.
For each selected change, Configuration Resilience checks whether the configuration has dependencies. If any are found, it flags them. These dependencies will be included in the deployment and cannot be excluded.
Add a note
Before submitting, click the clipboard icon to add an optional note for the administrator who will approve the changes, for example to explain why the change is needed.
Discard the changes
Select “Clear all” to remove all changes from the preview area.
Deploy
Click “Deploy” to submit the changes for approval.
The tenant status changes to “Pending approval”, and the approving administrator receives an email notification to approve or discard the changes. The changes are applied to the tenant only after approval.
After approval
When a deployment is approved, the tenant status changes to “Running Deploy”.
Processing time varies according to the dependency count and the number of configuration changes included in the deployment. When processing finishes, the tenant status changes to “Ready”.
Export alignment report
Use the “Actions” button in the upper-right corner of the page to download the Restore configurations report in your preferred format. The exported file includes the evaluated configurations, their descriptions, and their relative restored status at the time the export is generated.
