Configuration Resilience concepts

Before exploring Configuration Resilience, it is essential to understand the following key concepts:

Target tenant

The target tenant is the tenant where a deployment is applied. It is always the tenant you are signed in to, which is the tenant selected under “Managed tenants” in the top bar. To deploy configurations to a different tenant, select that tenant first.

Deploy status

Configuration Resilience shows you the Deploy status of the target tenant, which tells you whether the tenant can receive a new Deploy and, if not, why.

Only one Deploy can be active on a tenant at a time: a new Deploy can start only when the status is Ready.

Eventual consistency

Microsoft 365 processes some configuration changes asynchronously, so they may not appear immediately in Configuration Resilience. When the target tenant status shows Propagating, the deployment is complete, but Microsoft 365 is still applying the changes. Configuration Resilience may continue to show the previous value until the updated data is available; alignment status may update after the next scheduled backup or synchronization cycle. A completed Deploy means the deployment step has finished—not that every change is already visible in the tenant. For more information, see Understand propagation after a Deploy.

Baseline

A baseline is a fixed, point-in-time set of configuration states that represents the security standard defined by a recognized framework or industry benchmark. 

Unlike a real tenant, a baseline is not a live environment. It is a static reference model. Its configuration values are locked and do not drift over time because they represent what the framework defines as the expected secure state.

The baseline is used as a benchmark. The tenant’s configuration values are compared against it to identify gaps, deviations, and areas of non-compliance.

For the full list of baselines available in Configuration Resilience, see Available baselines.

Workload

Microsoft 365 service area used to group related configurations, such as Teams, SharePoint, and Entra ID.

Scopes, Configuration Types and Configurations

Scopes

A group of one or more related Configuration Types within a workload, such as Users, Groups, Licenses, or Tenant Domains. Scopes are defined by Configuration Resilience to make your tenant easier to navigate and monitor, so they may differ from how the same configurations are organized in the Microsoft 365 admin centers.

Severity and read frequency

Every scope within Configuration Resilience has a Severity rating, which reflects how important that group of configurations is from a security standpoint. Read frequency is tied to severity:

Configuration Resilience reads Low severity scopes once per day because these configurations carry no security impact.

Configuration Type

A group of configurations of the same kind, such as Conditional Access Policies or Compliance Policies. Each Configuration Type aligns with the Microsoft API Configuration Resilience uses to read and deploy those configurations. For example, the Meeting Policies Configuration Type (Teams > Meetings > Meeting Policies) contains all the Teams meeting policies in your tenant, including Global (Org-wide default) and any custom policies created by your administrators.

Configuration Types are organized into scopes, which bring related configurations together. They may not match how settings are grouped in the Microsoft 365 admin centers.

Configuration name

An individual item within a Configuration Type, made up of one or more properties that define its behavior. The configuration name reflects how the configuration appears in your Microsoft 365 tenant: it may be a name defined by your administrators or a default name assigned by Microsoft.

For example, within the Meeting Policies Configuration Type, Global (Org-wide default) is a configuration with a default name. It is the meeting policy that Microsoft Teams automatically applies to all users in the organization, unless they are assigned a different policy.

(Configuration) Property

A specific setting or attribute that defines part of a configuration's behavior. Each configuration is made up of one or more properties.

Each property consists of:

• A property name, which identifies the setting.
• A property value, which is the value currently assigned to it. Values can be of different types, such as Boolean (true/false), text, numbers, or lists.

For example, the Global (Org-wide default) meeting policy includes a property called AllowCloudRecording, which determines whether users can record meetings. If its value is True, users can record meetings; if it is False, they cannot.

Skipped

Skipped is a status that warns you that an operation did not complete successfully. It can apply to either a Backup or a Deploy. 

• Skipped backup: Configuration Resilience could not retrieve the current state of one or more configurations. It is shown with a yellow warning icon. Until the next scheduled backup completes successfully, you cannot open the affected configurations at property level, because their property data is unavailable or may be out of date. The status clears automatically once the next backup completes. A skipped backup can occur when Microsoft service or API responses prevent the backup from completing, for example because of Microsoft API throttling when the request volume exceeds service limits. 
• Skipped deploy: Configuration Resilience could not change one or more configurations as requested. A banner shows a possible explanation of what caused the error. 

Unchangeable configurations

Some configurations may be marked as Unchangeable when Microsoft does not support the action required to align them. In some cases, a configuration can be updated, added, or removed. In other cases, only one or two actions are supported.

Dependencies

Some configurations are marked as Dependencies because other configurations or objects, such as users or groups, rely on them. Review any changes carefully, as they may affect those related items.