Before exploring Configuration Resilience, it is essential to understand the following key concepts:
Target tenant
Configuration Resilience identifies the tenant where writing/deployment actions will be applied as well as its deployment status, which determines whether a new deployment can be started:
| Status | Description |
|---|---|
| Ready | Deployment can start at any time. |
| Pending approval | Deployment changes are waiting for administrator approval. |
| Running deploy | A deployment is currently being executed. |
| Propagating | Deployment is complete, but Microsoft 365 applies changes with eventual consistency. The update may take some time to become visible. |
Only one deployment can be active on a tenant at a time. If the tenant status is not Ready, new configuration changes cannot be deployed until the current deployment cycle is complete.
If the tenant remains in “Running deploy” for more than 24 hours, open a support request and include the operation ID.
Eventual consistency
Microsoft 365 accepts a configuration change first, then propagates it across its services over time. Until propagation is complete, different services may show different values; eventually, they converge on the new configuration.
A successful deploy in Configuration Resilience means that CoreView has written your change to Microsoft 365. It does not mean that every Microsoft 365 service in your tenant has already returned the new configuration.
Baseline
A baseline is a fixed, point-in-time set of configuration states that represents the security standard defined by a recognized framework or industry benchmark.
Unlike a real tenant, a baseline is not a live environment. It is a static reference model. Its configuration values are locked and do not drift over time because they represent what the framework defines as the expected secure state.
The baseline is used as a benchmark. The tenant’s configuration values are compared against it to identify gaps, deviations, and areas of non-compliance.
For the full list of baselines available in Configuration Resilience, see Available baselines.
Workload
Microsoft 365 service area used to group related configurations, such as Teams, SharePoint, and Entra ID.
Scopes, Configuration Types and Configurations
Scopes
A logical grouping of the Microsoft 365 areas you want to monitor, such as Users, Groups, Licenses, and Tenant Domains. Each scope brings related configurations together in one place, so you can monitor them as a single area.
Scopes reflect how Configuration Resilience organizes your tenant, which may differ from how the same configurations are organized in the Microsoft 365 admin centers.
Each scope contains one or more Configuration Types, and each Configuration Type lists the individual configurations retrieved from your tenant.
Severity and read frequency
Every scope within Configuration Resilience has a Severity rating, which reflects how important that group of configurations is from a security standpoint. Read frequency is tied to severity:
| Severity | Read frequency |
|---|---|
| High | Runs every 6 hours |
| Medium | Runs every 12 hours |
| Low | Runs every 24 hours |
Configuration Resilience reads Low severity scopes once per day because these configurations carry no security impact.
Configuration Type
Within each scope, configurations are grouped into Configuration Types. A Configuration Type groups configurations of the same kind, such as Conditional Access Policies and Compliance Policies. Each Configuration Type contains the individual configurations defined in your tenant.
For example, the Meeting Policies Configuration Type (Teams > Meetings > Meeting Policies) contains all the Teams meeting policies in your tenant, including Global (Org-wide default) and any custom policies created by your administrators.
(Individual) Configuration
An individual item within a Configuration Type.
Each configuration is made up of one or more properties that define its behavior. Its name reflects how it appears in your Microsoft 365 tenant: depending on the Configuration Type, it may be a name defined by your administrators or a default name assigned by Microsoft.
For example, within the Meeting Policies Configuration Type, Global (Org-wide default) is a configuration with a default name. It is the meeting policy that Microsoft Teams automatically applies to all users in the organization, unless they are assigned a different policy.
(Configuration) Property
A specific setting or attribute that defines part of a configuration's behavior. Each configuration is made up of one or more properties.
Each property consists of:
- A property name, which identifies the setting.
- A property value, which is the value currently assigned to it. Values can be of different types, such as Boolean (true/false), text, numbers, or lists.
For example, the Global (Org-wide default) meeting policy includes a property called AllowCloudRecording, which determines whether users can record meetings. If its value is True, users can record meetings; if it is False, they cannot.
Skipped read
A skipped read indicates that the most recent completed read is older than the scheduled read interval for the scope. It is visually represented by a yellow warning icon. The icon can also indicate a partial read.
Configurations that were not read cannot be opened at property level because property-level data is unavailable or may be stale. When the next scheduled backup completes the read, the skipped read status is cleared.
A skipped read can occur when Microsoft service or API responses prevent one or more reads from completing. One possible cause is Microsoft API throttling when request volume exceeds service limits.
Unchangeable configurations
Some configurations may be marked as Unchangeable when Microsoft does not support the action required to align them. In some cases, a configuration can be updated, added, or removed. In other cases, only one or two actions are supported.
Dependencies
Some configurations are marked as Dependencies because other configurations or objects, such as users or groups, rely on them. Review any changes carefully, as they may affect those related items.