Configuration Resilience continuously monitors your Microsoft 365 tenant's configurations and shows you when they change. It also lets you revert or standardize any change from a known state. Configuration Resilience can:
- Show you any configuration variations it detects.
- Tell you when one of those configurations changes.
- Revert or standardize a changed configuration by copying it from a known state — a baseline, a backup, or another tenant.
How Configuration Resilience works
Read and write permissions in Configuration Resilience
Configuration Resilience operates on your tenant under two separate levels of permission:
- Read permission. Established when Configuration Resilience is set up. It lets Configuration Resilience monitor your configurations and covers Backup, the action of reading a configuration's state from your tenant. Backup does not write anything to your tenant.
- Write permission. Optional: you grant it separately, only if you want Configuration Resilience to change anything in your tenant. It covers Deploy, the action of applying a configuration value to your tenant. Without write permission, Configuration Resilience can read and report on your configurations but cannot change them.
How Configuration Resilience reads your tenant's configuration state
Configuration Resilience reads the state of monitored configurations directly through Microsoft's own APIs and does not modify this data before displaying it, so the values shown match your tenant's current configuration. During onboarding, it creates an application inside your tenant and uses this application to establish the API connection it reads from.
How Configuration Resilience alerts you to configuration changes
Configuration Resilience alerts you when a monitored configuration changes. You can also open it directly at any time to see what changed, without waiting for an alert.
How Deploy reverts or standardizes a configuration
To run a Deploy, you select a source — a baseline, a previous backup, or another tenant — where Configuration Resilience has already read the desired value, and instruct it to copy that value into your tenant.
Sources you can deploy a configuration from
Configuration Resilience deploys a configuration value from one of the following sources:
A best-practice baseline
A baseline is a set of configuration values built to meet a specific security framework. Available baseline options include:
A previous backup
Configuration Resilience keeps a continuous history of backups.
For example, if a configuration changed today, you can restore it to the value recorded in yesterday's backup.
Another tenant
If you manage more than one Microsoft 365 tenant, you can compare their configurations in Configuration Resilience.
For example, if your organization has a correctly configured headquarters tenant and separate tenants in Europe, Asia, and Australia, you can compare the headquarters tenant against the Australian tenant and push a block of configurations from the headquarters tenant into it.
The three roles in Configuration Resilience: Admin, User, and Viewer
Configuration Resilience defines its own set of roles, separate from other CoreView modules. It has three roles:
- Admin: can do everything in Configuration Resilience, including the final approval or rejection of proposed changes and deploys.
- User: can propose changes and create alerts, but only an Admin can approve or run a deploy.
- Viewer: cannot propose changes. A Viewer can only observe how configurations change over time.
Which configurations Configuration Resilience covers
Configuration Resilience monitors close to 200 Microsoft 365 configurations. The full list is maintained in a knowledge base article documenting supported configurations.
Where to open Configuration Resilience
Configuration Resilience has two entry points:
- The dashboard, in the left-hand menu under “Dashboards > Configuration Resilience dashboard”.
- The Configurations section of the left-hand menu.