To allow Configuration Resilience to back up configurations and deploy changes, each tenant installed on the platform requires an authentication method.
Application authentication method
Configuration Resilience supports application authentication only. It requires a service principal in the tenant and authenticates as that service principal by using one of these credential types:
- Client secret: a password-like credential associated with the application registration in Microsoft Entra ID.
- Certificate: a credential based on a public/private key pair and associated with the application registration in Microsoft Entra ID.
Service principal identity
A service principal is the application identity in a Microsoft Entra tenant. Configuration Resilience uses this identity to:
- Authenticate to the tenant.
- Read configuration object types enabled for backup in Configuration Resilience.
- Apply permitted changes.
The available operations depend on the permissions granted to the service principal.
Read-only service principal
Configuration Resilience provides a read-only service principal option for organizations with strict security protocols that disallow write access to your tenant.
In read-only mode, Configuration Resilience:
- Can back up configuration objects enabled for backup in Configuration Resilience.
- Cannot deploy changes or restore configurations to the tenant.
The read-only service principal cannot read Exchange Online configurations. Use read-write mode to back up and monitor Exchange Online configurations.
To change a read-only service principal to read-write mode, use the [CoreView settings guide].