Configuration Resilience continuously monitors your Microsoft 365 tenant, so you always know when something changes and can quickly restore or align any change to the state you want. With Configuration Resilience you can:
- Detect configuration changes: see what changed, when it was detected, and how it differs from a previous state.
- Restore or align configurations: roll back a change using a previous backup, or align a configuration with a baseline or another tenant.
How Configuration Resilience works
How Configuration Resilience connects to your tenant
During onboarding, Configuration Resilience creates an application in your Microsoft 365 tenant to connect through Microsoft APIs. The permissions you grant determine what the tenant can do: read permissions let it back up and monitor configurations without changing your tenant; write permissions, granted separately, let it apply configuration changes.
Read and write permissions in Configuration Resilience
Configuration Resilience operates on your tenant under two separate levels of permission, each tied to one of its two core operations:
- Read permission (backup): granted during onboarding. It allows Configuration Resilience to run backups, which read and record the current state of your configurations. A backup does not write anything to your tenant.
- Write permission (deploy): optional, and granted separately only if you want Configuration Resilience to make changes in your tenant. It allows Configuration Resilience to run deploys, which apply configuration values to your tenant. Without write permission, Configuration Resilience can monitor and report on your configurations, but cannot change them.
How Configuration Resilience alerts you to configuration changes
Configuration Resilience organizes configurations into scopes. Each time a backup runs, Configuration Resilience compares it with the previous backups and records any differences for each scope, so you can review what changed and when the change was detected at any moment. For the scopes that you consider most crucial, you can also set up alerts to receive an email whenever a change is detected.
How Deploy resorts or aligns a configuration
A Deploy copies configuration values from a reference into the tenant you are signed in to. Depending on what you want to achieve, the reference can be a baseline, a previous backup, or another tenant. Before anything is applied, you can compare your current configurations with the reference and choose what to deploy. A Configuration Admin must approve every Deploy before Configuration Resilience applies it to your tenant. Deploy requires write permission.
References you can deploy from
Configuration Resilience deploys a configuration value from one of the following sources:
A baseline
A baseline is a set of configuration states that represents the security standard defined by a recognized framework or industry benchmark. Available baseline options include:
A previous backup
Configuration Resilience keeps a continuous history of backups.
For example, if a configuration changed today, you can restore it to the value recorded in yesterday's backup.
Another tenant
If you manage more than one Microsoft 365 tenant, you can compare their configurations in Configuration Resilience and align one tenant to another.
For example, your organization may use a primary tenant as the standard for its internal configuration and require all tenants to follow the same Conditional Access policies. Use Configuration Resilience to compare a tenant with the primary tenant and identify any missing policies.
To check whether two tenants are aligned, compare their configurations. A deployment is always applied to the tenant you are signed in to. To align a secondary tenant with the primary tenant, sign in to the secondary tenant and select the primary tenant as the reference.
The three roles in Configuration Resilience: Admin, User, and Viewer
Configuration Resilience defines its own set of roles, separate from other CoreView modules. It has three roles:
| Role | Description |
|---|---|
| Configuration Admins | Who can perform all actions, including the final approval or rejection of proposed changes and deployments. |
| Configuration Users | Who can create alerts, review configurations, and propose changes, but cannot approve deployments. |
| Configuration Viewers | Who have read-only access. They cannot propose changes. A Viewer can only observe how configurations change over time. |
Which configurations Configuration Resilience covers
The list of Microsoft 365 configurations monitored by Configuration Resilience is maintained and documented in the article Configurations supported by Configuration Resilience.
Where to open Configuration Resilience
Configuration Resilience has two entry points:
- The dashboard, in the left-hand menu under “Dashboards > Configuration Resilience dashboard”.
- The Configurations section of the left-hand menu.