To allow Configuration Resilience to back up configurations and deploy changes, each tenant installed on the platform requires an authentication method.
Application authentication method
Configuration Resilience supports application authentication. It requires a service principal in the tenant and authenticates as that service principal by using one of these credential types:
- Client secret: a password-like credential associated with the application registration in Microsoft Entra ID.
- Certificate: a credential based on a public/private key pair and associated with the application registration in Microsoft Entra ID.
Service principal identity
A service principal is the application identity in a Microsoft Entra tenant. Configuration Resilience uses this identity to:
- Authenticate to the tenant.
- Read configuration object types enabled for backup in Configuration Resilience.
- Apply permitted changes.
The available operations depend on the permissions granted to the service principal.
Read-only service principal
Configuration Resilience provides a read-only service principal option for organizations with strict security protocols that disallow write access to your tenant.
In read-only mode, Configuration Resilience:
- Can back up configuration objects enabled for backup in Configuration Resilience.
- Cannot deploy changes or restore configurations to the tenant.
The read-only service principal cannot read Exchange Online configurations. Use read-write mode to back up and monitor Exchange Online configurations.