This article lists the Microsoft 365 configurations protected by Configuration Resilience. All the supported configurations use Application authentication.
Supported configurations by workload
Entra ID
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Administrative Units & Membership | Administrative Units | MSGraph:AdministrativeUnits |
Client Secret |
| Administrative Units & Membership | Administrative Units > Members | MSGraph:AdministrativeUnits:Members:Ref |
Client Secret |
| App Governance Policies | Applications > Policies | MSGraph:Policies:DefaultAppManagementPolicy |
Client Secret |
| App Governance Policies | Enterprise Applications > Claims Mapping Policies | MSGraph:Policies:ClaimsMappingPolicies |
Client Secret |
| App Governance Policies | Enterprise Applications > Consent and Permissions > Admin Consent Settings | MSGraph:Policies:AdminConsentRequestPolicy |
Client Secret |
| App Governance Policies | Enterprise Applications > Token Lifetime Policies | MSGraph:Policies:TokenLifetimePolicies |
Client Secret |
| App Registrations | App Registrations | MSGraph:Applications |
Client Secret |
| App Registrations | App Registrations > Secrets | MSGraph:Applications:PasswordCredentials |
Client Secret |
| App Registrations | App Registrations > Token Lifetime Policies | MSGraph:Applications:TokenLifetimePolicies:Ref |
Client Secret |
| Authentication & Authorization Policies | Authentication Methods > Policies | MSGraph:Policies:AuthenticationMethodsPolicy |
Client Secret |
| Authentication & Authorization Policies | Authentication Methods > Policies > Method Settings | MSGraph:Policies:AuthenticationMethodsPolicy:AuthenticationMethodConfigurations |
Client Secret |
| Authentication & Authorization Policies | Authorization Policies | MSGraph:Policies:AuthorizationPolicy |
Client Secret |
| Authentication & Authorization Policies | Device Settings | MSGraph:Policies:DeviceRegistrationPolicy |
Client Secret |
| Authentication & Authorization Policies | Organization > Certificate-based Authentication | MSGraph:Organization:CertificateBasedAuthConfiguration |
Client Secret |
| Authentication & Authorization Policies | Security > Identity Protection > Users at Risk Detected Alerts¹ | MSGraph:IdentityProtection:Settings:Notifications |
Client Secret |
| Authentication & Authorization Policies | Users > User Settings > External Users | MSGraph:Policies:AuthenticationFlowPolicy |
Client Secret |
| Conditional Access | Security > Conditional Access > Authentication Contexts | MSGraph:Identity:ConditionalAccess:AuthenticationContextClassReferences |
Client Secret |
| Conditional Access | Security > Conditional Access > Authentication Strengths | MSGraph:Identity:ConditionalAccess:AuthenticationStrength:Policies |
Client Secret |
| Conditional Access | Security > Conditional Access > Named Locations | MSGraph:Identity:ConditionalAccess:NamedLocations |
Client Secret |
| Conditional Access | Security > Conditional Access > Policies | MSGraph:Identity:ConditionalAccess:Policies |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Default Settings | MSGraph:Policies:CrossTenantAccessPolicy:Default |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Microsoft Cloud Settings | MSGraph:Policies:CrossTenantAccessPolicy |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Organizational Settings | MSGraph:Policies:CrossTenantAccessPolicy:Partners |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Organizational Settings > Identity Synchronization | MSGraph:Policies:CrossTenantAccessPolicy:Partners:IdentitySynchronization |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:DirectoryRoles |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:RoleManagement:Directory:RoleAssignments |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:RoleManagement:Directory:RoleDefinitions |
Client Secret |
| Enterprise Applications | Enterprise Applications | MSGraph:ServicePrincipals |
Client Secret |
| Identity Governance | Conditional Access > Terms of Use | MSGraph:Agreements |
Client Secret |
| Identity Governance | Identity Governance > Access Reviews | MSGraph:IdentityGovernance:AccessReviews:Definitions |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations > External Sponsors | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations:ExternalSponsors:Ref |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations > Internal Sponsors | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations:InternalSponsors:Ref |
Client Secret |
| Licenses | Licenses > All Products | MSGraph:Licenses:Assignments |
Client Secret |
| Organization, Branding & Directory Settings | Company Branding | MSGraph:Organization |
Client Secret |
| Organization, Branding & Directory Settings | Company Branding > Localizations | MSGraph:Organization:Branding:Localizations |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes | MSGraph:Directory:AttributeSets |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes | MSGraph:Directory:CustomSecurityAttributeDefinitions |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes > Allowed Values | MSGraph:Directory:CustomSecurityAttributeDefinitions:AllowedValues |
Client Secret |
| Organization, Branding & Directory Settings | Directory Settings | MSGraph:Settings |
Client Secret |
| Organization, Branding & Directory Settings | Enterprise Applications > Home Realm Discovery Policies | MSGraph:ServicePrincipals:HomeRealmDiscoveryPolicies:Ref |
Client Secret |
| Organization, Branding & Directory Settings | Feature Rollout | MSGraph:Policies:FeatureRolloutPolicies |
Client Secret |
| Organization, Branding & Directory Settings | Feature Rollout > Applies to | MSGraph:Policies:FeatureRolloutPolicies:AppliesTo:Ref |
Client Secret |
| Organization, Branding & Directory Settings | Home Realm Discovery Policies | MSGraph:Policies:HomeRealmDiscoveryPolicies |
Client Secret |
| PIM | Privileged Identity Management > Entra Roles > Assignments (Active) | MSGraph:RoleManagement:Directory:RoleAssignmentSchedules |
Client Secret |
| PIM | Privileged Identity Management > Entra Roles > Assignments (Eligible) | MSGraph:RoleManagement:Directory:RoleEligibilitySchedules |
Client Secret |
| PIM | Privileged Identity Management > Policies and Rules | MSGraph:Policies:RoleManagementPolicies |
Client Secret |
| PIM | Privileged Identity Management > Policies and Rules > Rules | MSGraph:Policies:RoleManagementPolicies:Rules |
Client Secret |
¹ The only editable field for this configuration is the value: isRiskyUsersAlertsRecipient : true/false
| Dependency resources that are backed up and managed only when another configuration references them. | |||
|---|---|---|---|
| Groups | MSGraph:Groups |
Client Secret | |
| Groups > Members | MSGraph:Groups:Members:Ref |
Client Secret | |
| Groups > Expiration | MSGraph:GroupLifecyclePolicies |
Client Secret | |
| Groups > Expiration | MSGraph:Groups:GroupLifecyclePolicies |
Client Secret | |
| Groups > Owners | MSGraph:Groups:Owners:Ref |
Client Secret | |
| Users | MSGraph:Users |
Client Secret | |
Intune
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| App Protection Policies | Apps > App Protection Policies (Platform = Android) | MSGraph:DeviceAppManagement:AndroidManagedAppProtections |
Client Secret |
| App Protection Policies | Apps > App Protection Policies (Platform = iOS/iPadOS) | MSGraph:DeviceAppManagement:IosManagedAppProtections |
Client Secret |
| App Protection Policies | Apps > App Protection Policies (Platform = Windows 10) | MSGraph:DeviceAppManagement:MdmWindowsInformationProtectionPolicies |
Client Secret |
| Configuration Policies (Settings Catalog) | Devices > Configuration Profiles (Settings Catalog) | MSGraph:DeviceManagement:ConfigurationPolicies |
Client Secret |
| Configuration Policies (Settings Catalog) | Endpoint Security > Firewall > Reusable Settings | MSGraph:DeviceManagement:ReusablePolicySettings |
Client Secret |
| Configuration Policies (Settings Catalog) | Endpoint Security > Security Baselines | MSGraph:DeviceManagement:Templates |
Client Secret |
| Device Compliance Policies | Devices > Compliance > Policies | MSGraph:DeviceManagement:DeviceCompliancePolicies |
Client Secret |
| Device Compliance Policies | Devices > Compliance > Scripts | MSGraph:DeviceManagement:DeviceComplianceScripts |
Client Secret |
| Device Compliance Policies | Devices > Compliance Policies > Compliance Policy Settings | MSGraph:DeviceManagement |
Client Secret |
| Device Configuration Profiles | Devices > Configuration Profiles | MSGraph:Policies:AuthenticationMethodsPolicy |
Client Secret |
| Device Configuration Profiles | Devices > Configuration Profiles > Assignments | MSGraph:Policies:AuthenticationMethodsPolicy:AuthenticationMethodConfigurations |
Client Secret |
| Endpoint Security Intents | Endpoint Security | MSGraph:DeviceManagement:Intents |
Client Secret |
| Endpoint Security Intents | Endpoint Security > Settings | MSGraph:DeviceManagement:Intents:Settings |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Import ADMX) | MSGraph:DeviceManagement:GroupPolicyUploadedDefinitionFiles |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) | MSGraph:DeviceManagement:GroupPolicyConfigurations |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) | MSGraph:DeviceManagement:GroupPolicyDefinitions |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) > Assignments | MSGraph:DeviceManagement:GroupPolicyConfigurations:Assignments |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) > Definition Values | MSGraph:DeviceManagement:GroupPolicyConfigurations:DefinitionValues |
Client Secret |
| Intune – Delegated Auth Settings | Apps > App Configuration Policies | MSGraph:Identity:ConditionalAccess:NamedLocations |
Client Secret |
| Intune – Delegated Auth Settings | Devices > Enrollment Restrictions | MSGraph:Identity:ConditionalAccess:Policies |
Client Secret |
| Intune – Delegated Auth Settings | Reports > Endpoint Analytics > Proactive Remediations | MSGraph:Policies:CrossTenantAccessPolicy:Default |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Compliance Policies > Notifications | MSGraph:DeviceManagement:NotificationMessageTemplates |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Compliance Policies > Notifications > Localized Notification Messages | MSGraph:DeviceManagement:NotificationMessageTemplates:LocalizedNotificationMessages |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Feature Updates for Windows 10 and Later | MSGraph:DeviceManagement:WindowsFeatureUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Quality Updates for Windows 10 and Later | MSGraph:DeviceManagement:WindowsQualityUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Autopilot Deployment Profiles | MSGraph:DeviceManagement:WindowsAutopilotDeploymentProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Autopilot Deployment Profiles > Assignments | MSGraph:DeviceManagement:WindowsAutopilotDeploymentProfiles:Assignments |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Updates > Driver Updates | MSGraph:DeviceManagement:WindowsDriverUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Filters | MSGraph:DeviceManagement:AssignmentFilters |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles | MSGraph:DeviceManagement:RoleDefinitions |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Role Assignments | MSGraph:DeviceManagement:RoleDefinitions:RoleAssignments |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Scope Tags | MSGraph:DeviceManagement:RoleScopeTags |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Scope Tags > Assignments | MSGraph:DeviceManagement:RoleScopeTags:Assignments |
Client Secret |
| Mobile Apps & App Configuration | Apps | MSGraph:DeviceAppManagement:MobileApps |
Client Secret |
| Mobile Apps & App Configuration | Apps | MSGraph:DeviceAppManagement:MobileApps:Assignments |
Client Secret |
| Mobile Apps & App Configuration | Apps > App Configuration Policies | MSGraph:DeviceAppManagement:MobileAppConfigurations |
Client Secret |
| Mobile Apps & App Configuration | Policy Sets | MSGraph:DeviceAppManagement:PolicySets |
Client Secret |
| Scripts & Proactive Remediations | Devices > Scripts | MSGraph:DeviceManagement:DeviceManagementScripts |
Client Secret |
| Scripts & Proactive Remediations | Devices > Scripts | MSGraph:DeviceManagement:DeviceShellScripts |
Client Secret |
Exchange Online
Note: to correctly manage Address Lists, Global Access Lists and Offline Address Books, manual setups may be required.
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Distribution Group Members | Distribution Groups > Members | ExchangeOnline:DistributionGroupMember |
Client Secret |
| Exchange Mail Flow & Client Access | Availability Address Spaces | MSGraph:DeviceAppManagement:IosManagedAppProtections |
Client Secret |
| Exchange Mail Flow & Client Access | Availability Config | MSGraph:DeviceAppManagement:MdmWindowsInformationProtectionPolicies |
Client Secret |
| Exchange Mail Flow & Client Access | Mobile Device Access > Device Access Rules | ExchangeOnline:ActiveSyncDeviceAccessRule |
Client Secret |
| Exchange Mail Flow & Client Access | Mobile Device Mailbox Policies | ExchangeOnline:MobileDeviceMailboxPolicy |
Client Secret |
| Exchange Mail Flow & Client Access | Partner Applications | ExchangeOnline:PartnerApplication |
Client Secret |
| Exchange Mail Flow & Client Access | Policy Tip Config | ExchangeOnline:PolicyTipConfig |
Client Secret |
| Exchange Mail Flow & Client Access | Transport Rules | ExchangeOnline:TransportRule |
Client Secret |
| Exchange Recipients & Address Book | Distribution Groups | ExchangeOnline:DistributionGroup |
Client Secret |
| Exchange Recipients & Address Book | Dynamic Distribution Groups | ExchangeOnline:DynamicDistributionGroup |
Client Secret |
| Exchange Recipients & Address Book | Mail Flow > Accepted Domains | ExchangeOnline:AcceptedDomain |
Client Secret |
| Exchange Role Groups | Role Groups | ExchangeOnline:RoleGroup |
Client Secret |
| Exchange Role Groups | Role Groups > Members | ExchangeOnline:RoleGroupMember |
Client Secret |
| Mailbox Permissions | Mailboxes > Permissions | ExchangeOnline:MailboxPermission |
Client Secret |
| Mailboxes | Mailboxes | ExchangeOnline:Mailbox |
Client Secret |
Defender
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Anti-phishing | ExchangeOnline:AntiPhishRule |
Client Secret |
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Safe Attachments | ExchangeOnline:SafeAttachmentRule |
Client Secret |
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Safe Links | ExchangeOnline:SafeLinksRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedContentFilterPolicy |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedContentFilterRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedOutboundSpamFilterRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Policies & Rules > Threat Policies > Email Authentication Settings | ExchangeOnline:DkimSigningConfig |
Client Secret |
| Defender – Device Policies & Hunting | Configuration Management > Device Configuration | Defender:DevicePolicies |
Client Secret |
| Defender – Device Policies & Hunting | Hunting > Advanced Hunting > Queries > Shared Queries | Defender:HuntingService:Queries |
Client Secret |
Purview
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Purview – Retention & Records | Data Lifecycle Management > Exchange (legacy) > MRM Retention Tags | ExchangeOnline:RetentionPolicyTag |
Client Secret |
| Purview – Retention & Records | Data Lifecycle Management > Journal Rules | ExchangeOnline:JournalRule |
Client Secret |
Teams
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Teams Policies & Settings | Meetings > Meeting Settings | Teams:CsTeamsMeetingConfiguration |
Client Secret |
SharePoint Online
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| SharePoint Tenant Settings | Settings | MSGraph:Admin:Sharepoint:Settings |
Client Secret |
Microsoft 365 Admin Center
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Tenant Domains | Domains | MSGraph:Domains |
Client Secret |
| Tenant Domains | Domains > Federation Configuration | MSGraph:Domains:FederationConfiguration |
Client Secret |
Azure
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Customer Lockbox | Customer Lockbox for Microsoft Azure | AzureManagement:Providers:Microsoft:CustomerLockbox |
Client Secret |
Configurations requiring tenant-specific setup
Complete the tenant-specific role assignments described below before managing these additional configurations in Configuration Resilience.
Exchange Online - Address Lists
Configuration Resilience requires a one-time Exchange Online Address Lists role assignment for the following resource types:
- Address Lists
- Global Address Lists
- Offline Address Books
Without this role assignment, Exchange Online cannot authorize the address-list management cmdlets used for these resource types. Resources outside this list do not require this role assignment.
One-time setup
- Assign the Address Lists role to the CoreView Configuration Manager App in each tenant where you manage address lists.
- Run the CoreView PowerShell script to assign the Exchange Online Address Lists role to the CoreView enterprise application. Run the script once for each tenant:
Configure-ExchangeAddressListsAppOnly.ps
Assign the Address Lists role
- Sign in to the target tenant with an account assigned the Exchange Administrator or Global Administrator role.
- Open the Microsoft Entra admin center.
- Open Enterprise applications and select the CoreView Configuration Manager App.
- In the application’s Overview page, copy the value in the Application (client) ID field.
- Copy the Object ID displayed for the Configuration Manager App. Do not use the Object ID from App registrations because it identifies a different directory object.
- Run the CoreView PowerShell script.
- When prompted, enter the Application (client) ID and the Configuration Manager App Object ID.
- When prompted to authenticate, sign in with the administrator account.
- Verify that the script reports the Address Lists role assignment as “Completed”.
- Wait for Exchange Online to apply the role assignment before retrying a backup or deployment that includes address lists. Follow the retry guidance in the CoreView script documentation.
Entra ID - Administrative Units
Deploying Administrative Units (AdministrativeUnits and AdministrativeUnits:Members:Ref) requires the Microsoft Graph application permission AdministrativeUnit.ReadWrite.All on the Configuration Manager app registration in your tenant.
This permission is not added automatically. If it is missing, the deployment fails, and an error in the deployment history prompts you to add the permission and grant admin consent.
To add the permission:
- In the Microsoft Entra admin center, open the Configuration Manager app registration.
- Go to API permissions and select “Add a permission”.
- Select Microsoft Graph > Application permissions.
- Select
AdministrativeUnit.ReadWrite.All, then select "Add permissions". - Select “Grant admin consent” for your tenant.
- Once admin consent is granted, retry the deployment.
Configurations that need specific license requirements
Some Microsoft 365 configurations are available only with a specific license. Before onboarding a tenant, check that it has the licenses listed in this section.
If the tenant does not have a required license, Configuration Resilience skips only the configurations that depend on it. Other configurations in the same workload are still protected.
Adding a license does not create the configurations. After the license is active, create the configurations in the tenant, then run a new backup.
Required licenses by workload
Entra ID
| License needed | Configurations covered |
|---|---|
| Microsoft Entra ID Free | All configurations not listed below. |
| Microsoft Entra ID P1 | Conditional Access policies. |
| Microsoft Entra ID P2 | Conditional Access policies that use sign-in risk or user risk. |
| Microsoft Entra ID P2 | Identity Protection alerts (Users at Risk Detected Alerts). |
| Microsoft Entra ID P2 or Microsoft Entra ID Governance | Privileged Identity Management (assignments, policies and rules). |
| Microsoft Entra ID P2 or Microsoft Entra ID Governance | Access reviews. |
| Microsoft Entra ID Governance | Connected organizations. Some entitlement management capabilities also work with Microsoft Entra ID P2. |
Intune
| License needed | Configurations covered |
|---|---|
| Microsoft Intune Plan 1 | All configurations |
Exchange Online
| License needed | Configurations covered |
|---|---|
| Exchange Online Plan 1 | All configurations |
Defender
| License needed | Configurations covered |
|---|---|
| Exchange Online | Anti-spam. |
| Exchange Online | DKIM. |
| Exchange Online | Anti-phishing. |
| Microsoft Defender for Office 365 Plan 1 | Safe Links. |
| Microsoft Defender for Office 365 Plan 1 | Safe Attachments. |
| Microsoft Defender for Office 365 Plan 1 | Anti-phishing impersonation settings. |
| Microsoft Defender for Endpoint Plan 2 | Device policies. |
| Microsoft Defender for Endpoint Plan 2 | Advanced hunting. |
| Microsoft Defender for Endpoint Plan 2 | Defender XDR email notifications. |
Purview
| License needed | Configurations covered |
|---|---|
| Microsoft 365 E3 | All configurations. |
Teams
| License needed | Configurations covered |
|---|---|
| Microsoft Teams | All configurations. |
SharePoint Online
| License needed | Configurations covered |
|---|---|
| SharePoint Online | All configurations. |
Microsoft 365 Admin Center
| License needed | Configurations covered |
|---|---|
| No additional license | All configurations. |
Azure
| License needed | Configurations covered |
|---|---|
| Azure subscription | Resource groups. |
| Azure subscription | Storage accounts. |
| Azure support plan Developer or higher | Customer Lockbox for Microsoft Azure. |
Where required licenses are included
| License | Included in |
|---|---|
| Microsoft Entra ID P1 | Microsoft 365 E3, Microsoft 365 Business Premium. |
| Microsoft Entra ID P2 | Microsoft 365 E5. |
| Microsoft Entra ID Governance | Separate add-on. |
| Microsoft Intune Plan 1 | Microsoft 365 E3. |
| Exchange Online Plan 1 | Microsoft 365. |
| Microsoft Defender for Endpoint Plan 2 | Microsoft 365 E5. |
| Microsoft Teams | Most Microsoft 365 plans. |
| SharePoint Online | Microsoft 365. |
Configurations with limited actions
Microsoft APIs do not support every action for every configuration. As a result, a configuration may appear as “Unchangeable” in Configuration Resilience when the action you need is not supported. The table below shows which actions are available for each configuration.
- Update only: you can update the configuration, but you cannot add or remove it.
- Add and Remove only: you can add or remove the configuration, but you cannot update it.
- Add and Update only: you can add or update the configuration, but you cannot remove it.
- Add only: you can add the configuration, but you cannot update or remove it.
- Read only: the configuration is backed up, but you cannot add, update, or remove it.
Configurations with limited actions by workload
Entra ID
| Supported action | Configurations |
|---|---|
| Update only | Applications > Policies |
| Update only | Enterprise Applications > Consent and Permissions > Admin Consent Settings |
| Update only | Authentication Methods > Policies |
| Update only | Authentication Methods > Policies > Method Settings |
| Update only | Authorization Policies |
| Update only | Device Settings |
| Update only | Security > Identity Protection > Users at Risk Detected Alerts |
| Update only | Users > User Settings > External Users |
| Update only | External Identities > Cross-tenant Access Settings > Default Settings |
| Update only | External Identities > Cross-tenant Access Settings > Microsoft Cloud Settings |
| Update only | Company Branding |
| Update only | Privileged Identity Management > Policies and Rules > Rules |
| Add and Remove only | Administrative Units > Members |
| Add and Remove only | App Registrations > Token Lifetime Policies |
| Add and Remove only | Groups > Members |
| Add and Remove only | Groups > Expiration |
| Add and Remove only | Groups > Owners |
| Add and Remove only | Identity Governance > Connected Organizations > External Sponsors |
| Add and Remove only | Identity Governance > Connected Organizations > Internal Sponsors |
| Add and Remove only | Licenses > All Products |
| Add and Remove only | Enterprise Applications > Home Realm Discovery Policies |
| Add and Remove only | Feature Rollout > Applies to |
| Add and Update only | Custom Security Attributes |
| Add and Update only | Custom Security Attributes > Allowed Values |
| Add only | Roles and Administrators |
| Read only | App Registrations > Secrets |
| Read only | Security > Conditional Access > Authentication Strengths |
Intune
| Supported action | Configurations |
|---|---|
| Update only | Endpoint Security > Settings |
| Add and Remove only | Devices > Configuration Profiles (Profile Type = Administrative Templates) > Assignments |
| Add and Remove only | Devices > Windows Autopilot Deployment Profiles > Assignments |
| Add and Remove only | Tenant Administration > Roles > Scope Tags > Assignments |
| Add and Remove only | Apps |
| Read only | Endpoint Security > Security Baselines |
| Read only | Devices > Configuration Profiles (Import ADMX) |
| Read only | Devices > Configuration Profiles (Profile Type = Administrative Templates) |
| Read only | Mobile Apps & App Configuration > Apps > MSGraph:DeviceAppManagement:MobileApps
|
Exchange Online
| Supported action | Configurations |
|---|---|
| Update only | Availability Config |
| Update only | Mail Flow > Accepted Domains |
| Add and Remove only | Distribution Groups > Members |
| Add and Remove only | Role Groups > Members |
| Add and Remove only | Mailboxes > Permissions |
Teams
| Supported action | Configurations |
|---|---|
| Update only | Meetings > Meeting Settings |
SharePoint Online
| Supported action | Configurations |
|---|---|
| Update only | Settings |
Microsoft 365 Admin Center
| Supported action | Configurations |
|---|---|
| Add and Update only | Domains |
Azure
| Supported action | Configurations |
|---|---|
| Update only | Customer Lockbox for Microsoft Azure |
All other configurations not listed in the table above support Add, Update and Remove.