To allow Configuration Resilience to back up configurations and deploy changes, each tenant installed on the platform requires an authentication method.
Application authentication method
Configuration Resilience supports application authentication. It requires a service principal in the tenant and authenticates as that service principal by using one of these credential types:
- Client secret: a password-like credential associated with the application registration in Microsoft Entra ID.
- Certificate: a credential based on a public/private key pair and associated with the application registration in Microsoft Entra ID.
Service principal identity
A service principal is the application identity in a Microsoft Entra tenant. Configuration Resilience uses this identity to:
- Authenticate to the tenant.
- Read configuration object types enabled for backup in Configuration Resilience.
- Apply permitted changes.
The available operations depend on the permissions granted to the service principal.
Permission modes
You can grant Configuration Resilience Read-only or Read-write permissions. The selected mode determines whether Configuration Resilience capabilities that require write permissions, such as Restore Configurations, are available.
Read-only service principal
Configuration Resilience provides a Read-only service principal option for organizations with strict security protocols that disallow write access to your tenant.
In Read-only mode, Configuration Resilience:
- Can back up configuration objects enabled for backup in Configuration Resilience.
- Cannot deploy changes or restore configurations to the tenant.
The Read-only service principal cannot read Exchange Online configurations. Use Read-write mode to back up and monitor Exchange Online configurations.