Configuration Resilience supports 129 configurations across 9 workloads. All the supported configurations use Application authentication.
Supported configurations by workload
Entra ID
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Administrative Units & Membership | Administrative Units | MSGraph:AdministrativeUnits |
Client Secret |
| Administrative Units & Membership | Administrative Units > Members | MSGraph:AdministrativeUnits:Members:Ref |
Client Secret |
| App Governance Policies | Applications > Policies | MSGraph:Policies:DefaultAppManagementPolicy |
Client Secret |
| App Governance Policies | Enterprise Applications > Claims Mapping Policies | MSGraph:Policies:ClaimsMappingPolicies |
Client Secret |
| App Governance Policies | Enterprise Applications > Consent and Permissions > Admin Consent Settings | MSGraph:Policies:AdminConsentRequestPolicy |
Client Secret |
| App Governance Policies | Enterprise Applications > Token Lifetime Policies | MSGraph:Policies:TokenLifetimePolicies |
Client Secret |
| App Registrations | App Registrations | MSGraph:Applications |
Client Secret |
| App Registrations | App Registrations > Secrets | MSGraph:Applications:PasswordCredentials |
Client Secret |
| App Registrations | App Registrations > Token Lifetime Policies | MSGraph:Applications:TokenLifetimePolicies:Ref |
Client Secret |
| Authentication & Authorization Policies | Authentication Methods > Policies | MSGraph:Policies:AuthenticationMethodsPolicy |
Client Secret |
| Authentication & Authorization Policies | Authentication Methods > Policies > Method Settings | MSGraph:Policies:AuthenticationMethodsPolicy:AuthenticationMethodConfigurations |
Client Secret |
| Authentication & Authorization Policies | Authorization Policies | MSGraph:Policies:AuthorizationPolicy |
Client Secret |
| Authentication & Authorization Policies | Device Settings | MSGraph:Policies:DeviceRegistrationPolicy |
Client Secret |
| Authentication & Authorization Policies | Organization > Certificate-based Authentication | MSGraph:Organization:CertificateBasedAuthConfiguration |
Client Secret |
| Authentication & Authorization Policies | Security > Identity Protection > Users at Risk Detected Alerts | MSGraph:IdentityProtection:Settings:Notifications |
Client Secret |
| Authentication & Authorization Policies | Users > User Settings > External Users | MSGraph:Policies:AuthenticationFlowPolicy |
Client Secret |
| Conditional Access | Security > Conditional Access > Authentication Contexts | MSGraph:Identity:ConditionalAccess:AuthenticationContextClassReferences |
Client Secret |
| Conditional Access | Security > Conditional Access > Authentication Strengths | MSGraph:Identity:ConditionalAccess:AuthenticationStrength:Policies |
Client Secret |
| Conditional Access | Security > Conditional Access > Named Locations | MSGraph:Identity:ConditionalAccess:NamedLocations |
Client Secret |
| Conditional Access | Security > Conditional Access > Policies | MSGraph:Identity:ConditionalAccess:Policies |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Default Settings | MSGraph:Policies:CrossTenantAccessPolicy:Default |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Microsoft Cloud Settings | MSGraph:Policies:CrossTenantAccessPolicy |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Organizational Settings | MSGraph:Policies:CrossTenantAccessPolicy:Partners |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Organizational Settings > Identity Synchronization | MSGraph:Policies:CrossTenantAccessPolicy:Partners:IdentitySynchronization |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:DirectoryRoles |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:RoleManagement:Directory:RoleAssignments |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:RoleManagement:Directory:RoleDefinitions |
Client Secret |
| Enterprise Applications | Enterprise Applications | MSGraph:ServicePrincipals |
Client Secret |
| Group Membership | Groups > Members | MSGraph:Groups:Members:Ref |
Client Secret |
| Groups | Groups | MSGraph:Groups |
Client Secret |
| Groups | Groups > Expiration | MSGraph:GroupLifecyclePolicies |
Client Secret |
| Groups | Groups > Expiration | MSGraph:Groups:GroupLifecyclePolicies |
Client Secret |
| Groups | Groups > Owners | MSGraph:Groups:Owners:Ref |
Client Secret |
| Identity Governance | Conditional Access > Terms of Use | MSGraph:Agreements |
Client Secret |
| Identity Governance | Identity Governance > Access Reviews | MSGraph:IdentityGovernance:AccessReviews:Definitions |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations > External Sponsors | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations:ExternalSponsors:Ref |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations > Internal Sponsors | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations:InternalSponsors:Ref |
Client Secret |
| Licenses | Licenses > All Products | MSGraph:Licenses:Assignments |
Client Secret |
| Organization, Branding & Directory Settings | Company Branding | MSGraph:Organization |
Client Secret |
| Organization, Branding & Directory Settings | Company Branding > Localizations | MSGraph:Organization:Branding:Localizations |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes | MSGraph:Directory:AttributeSets |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes | MSGraph:Directory:CustomSecurityAttributeDefinitions |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes > Allowed Values | MSGraph:Directory:CustomSecurityAttributeDefinitions:AllowedValues |
Client Secret |
| Organization, Branding & Directory Settings | Directory Settings | MSGraph:Settings |
Client Secret |
| Organization, Branding & Directory Settings | Enterprise Applications > Home Realm Discovery Policies | MSGraph:ServicePrincipals:HomeRealmDiscoveryPolicies:Ref |
Client Secret |
| Organization, Branding & Directory Settings | Feature Rollout | MSGraph:Policies:FeatureRolloutPolicies |
Client Secret |
| Organization, Branding & Directory Settings | Feature Rollout > Applies to | MSGraph:Policies:FeatureRolloutPolicies:AppliesTo:Ref |
Client Secret |
| Organization, Branding & Directory Settings | Home Realm Discovery Policies | MSGraph:Policies:HomeRealmDiscoveryPolicies |
Client Secret |
| PIM | Privileged Identity Management > Entra Roles > Assignments (Active) | MSGraph:RoleManagement:Directory:RoleAssignmentSchedules |
Client Secret |
| PIM | Privileged Identity Management > Entra Roles > Assignments (Eligible) | MSGraph:RoleManagement:Directory:RoleEligibilitySchedules |
Client Secret |
| PIM | Privileged Identity Management > Policies and Rules | MSGraph:Policies:RoleManagementPolicies |
Client Secret |
| PIM | Privileged Identity Management > Policies and Rules > Rules | MSGraph:Policies:RoleManagementPolicies:Rules |
Client Secret |
| Users | Users | MSGraph:Users |
Client Secret |
Intune
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| App Protection Policies | Apps > App Protection Policies (Platform = Android) | MSGraph:DeviceAppManagement:AndroidManagedAppProtections |
Client Secret |
| App Protection Policies | Apps > App Protection Policies (Platform = iOS/iPadOS) | MSGraph:DeviceAppManagement:IosManagedAppProtections |
Client Secret |
| App Protection Policies | Apps > App Protection Policies (Platform = Windows 10) | MSGraph:DeviceAppManagement:MdmWindowsInformationProtectionPolicies |
Client Secret |
| Configuration Policies (Settings Catalog) | Devices > Configuration Profiles (Settings Catalog) | MSGraph:DeviceManagement:ConfigurationPolicies |
Client Secret |
| Configuration Policies (Settings Catalog) | Endpoint Security > Firewall > Reusable Settings | MSGraph:DeviceManagement:ReusablePolicySettings |
Client Secret |
| Configuration Policies (Settings Catalog) | Endpoint Security > Security Baselines | MSGraph:DeviceManagement:Templates |
Client Secret |
| Device Compliance Policies | Devices > Compliance > Policies | MSGraph:DeviceManagement:DeviceCompliancePolicies |
Client Secret |
| Device Compliance Policies | Devices > Compliance > Scripts | MSGraph:DeviceManagement:DeviceComplianceScripts |
Client Secret |
| Device Compliance Policies | Devices > Compliance Policies > Compliance Policy Settings | MSGraph:DeviceManagement |
Client Secret |
| Device Configuration Profiles | Devices > Configuration Profiles | MSGraph:Policies:AuthenticationMethodsPolicy |
Client Secret |
| Device Configuration Profiles | Devices > Configuration Profiles > Assignments | MSGraph:Policies:AuthenticationMethodsPolicy:AuthenticationMethodConfigurations |
Client Secret |
| Endpoint Security Intents | Endpoint Security | MSGraph:DeviceManagement:Intents |
Client Secret |
| Endpoint Security Intents | Endpoint Security > Settings | MSGraph:DeviceManagement:Intents:Settings |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Import ADMX) | MSGraph:DeviceManagement:GroupPolicyUploadedDefinitionFiles |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) | MSGraph:DeviceManagement:GroupPolicyConfigurations |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) | MSGraph:DeviceManagement:GroupPolicyDefinitions |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) > Assignments | MSGraph:DeviceManagement:GroupPolicyConfigurations:Assignments |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) > Definition Values | MSGraph:DeviceManagement:GroupPolicyConfigurations:DefinitionValues |
Client Secret |
| Intune – Delegated Auth Settings | Apps > App Configuration Policies | MSGraph:Identity:ConditionalAccess:NamedLocations |
Client Secret |
| Intune – Delegated Auth Settings | Devices > Enrollment Restrictions | MSGraph:Identity:ConditionalAccess:Policies |
Client Secret |
| Intune – Delegated Auth Settings | Reports > Endpoint Analytics > Proactive Remediations | MSGraph:Policies:CrossTenantAccessPolicy:Default |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Compliance Policies > Notifications | MSGraph:DeviceManagement:NotificationMessageTemplates |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Compliance Policies > Notifications > Localized Notification Messages | MSGraph:DeviceManagement:NotificationMessageTemplates:LocalizedNotificationMessages |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Feature Updates for Windows 10 and Later | MSGraph:DeviceManagement:WindowsFeatureUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Quality Updates for Windows 10 and Later | MSGraph:DeviceManagement:WindowsQualityUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Autopilot Deployment Profiles | MSGraph:DeviceManagement:WindowsAutopilotDeploymentProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Autopilot Deployment Profiles > Assignments | MSGraph:DeviceManagement:WindowsAutopilotDeploymentProfiles:Assignments |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Updates > Driver Updates | MSGraph:DeviceManagement:WindowsDriverUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Filters | MSGraph:DeviceManagement:AssignmentFilters |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles | MSGraph:DeviceManagement:RoleDefinitions |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Role Assignments | MSGraph:DeviceManagement:RoleDefinitions:RoleAssignments |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Scope Tags | MSGraph:DeviceManagement:RoleScopeTags |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Scope Tags > Assignments | MSGraph:DeviceManagement:RoleScopeTags:Assignments |
Client Secret |
| Mobile Apps & App Configuration | Apps | MSGraph:DeviceAppManagement:MobileApps |
Client Secret |
| Mobile Apps & App Configuration | Apps | MSGraph:DeviceAppManagement:MobileApps:Assignments |
Client Secret |
| Mobile Apps & App Configuration | Apps > App Configuration Policies | MSGraph:DeviceAppManagement:MobileAppConfigurations |
Client Secret |
| Mobile Apps & App Configuration | Policy Sets | MSGraph:DeviceAppManagement:PolicySets |
Client Secret |
| Scripts & Proactive Remediations | Devices > Scripts | MSGraph:DeviceManagement:DeviceManagementScripts |
Client Secret |
| Scripts & Proactive Remediations | Devices > Scripts | MSGraph:DeviceManagement:DeviceShellScripts |
Client Secret |
Exchange Online
Note: follow these steps [link] to setup Address Lists, Global Access Lists and Offline Address Books.
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Distribution Group Members | Distribution Groups > Members | ExchangeOnline:DistributionGroupMember |
Client Secret |
| Exchange Mail Flow & Client Access | Availability Address Spaces | MSGraph:DeviceAppManagement:IosManagedAppProtections |
Client Secret |
| Exchange Mail Flow & Client Access | Availability Config | MSGraph:DeviceAppManagement:MdmWindowsInformationProtectionPolicies |
Client Secret |
| Exchange Mail Flow & Client Access | Mobile Device Access > Device Access Rules | ExchangeOnline:ActiveSyncDeviceAccessRule |
Client Secret |
| Exchange Mail Flow & Client Access | Mobile Device Mailbox Policies | ExchangeOnline:MobileDeviceMailboxPolicy |
Client Secret |
| Exchange Mail Flow & Client Access | Partner Applications | ExchangeOnline:PartnerApplication |
Client Secret |
| Exchange Mail Flow & Client Access | Policy Tip Config | ExchangeOnline:PolicyTipConfig |
Client Secret |
| Exchange Mail Flow & Client Access | Transport Rules | ExchangeOnline:TransportRule |
Client Secret |
| Exchange Recipients & Address Book | Distribution Groups | ExchangeOnline:DistributionGroup |
Client Secret |
| Exchange Recipients & Address Book | Dynamic Distribution Groups | ExchangeOnline:DynamicDistributionGroup |
Client Secret |
| Exchange Recipients & Address Book | Mail Flow > Accepted Domains | ExchangeOnline:AcceptedDomain |
Client Secret |
| Exchange Role Groups | Role Groups | ExchangeOnline:RoleGroup |
Client Secret |
| Exchange Role Groups | Role Groups > Members | ExchangeOnline:RoleGroupMember |
Client Secret |
| Mailbox Permissions | Mailboxes > Permissions | ExchangeOnline:MailboxPermission |
Client Secret |
| Mailboxes | Mailboxes | ExchangeOnline:Mailbox |
Client Secret |
Defender
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Defender – Action & Incident Notifications | Settings > Microsoft Defender XDR > Email Notifications > Actions | Defender:Settings:ActionNotificationSettings |
Client Secret |
| Defender – Action & Incident Notifications | Settings > Microsoft Defender XDR > Email Notifications > Incidents | Defender:Settings:IncidentNotificationSettings |
Client Secret |
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Anti-phishing | ExchangeOnline:AntiPhishRule |
Client Secret |
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Safe Attachments | ExchangeOnline:SafeAttachmentRule |
Client Secret |
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Safe Links | ExchangeOnline:SafeLinksRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedContentFilterPolicy |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedContentFilterRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedOutboundSpamFilterRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Policies & Rules > Threat Policies > Email Authentication Settings | ExchangeOnline:DkimSigningConfig |
Client Secret |
| Defender – Device Policies & Hunting | Configuration Management > Device Configuration | Defender:DevicePolicies |
Client Secret |
| Defender – Device Policies & Hunting | Hunting > Advanced Hunting > Queries > Shared Queries | Defender:HuntingService:Queries |
Client Secret |
Purview
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Purview – eDiscovery & Case Hold | eDiscovery > Cases | SecurityAndCompliance:CaseHoldPolicy |
Client Secret |
| Purview – eDiscovery & Case Hold | eDiscovery > Cases | SecurityAndCompliance:CaseHoldRule |
Client Secret |
| Purview – eDiscovery & Case Hold | eDiscovery > Cases | SecurityAndCompliance:ComplianceCase |
Client Secret |
| Purview – Retention & Records | Data Lifecycle Management > Exchange (legacy) > MRM Retention Tags | ExchangeOnline:RetentionPolicyTag |
Client Secret |
| Purview – Retention & Records | Data Lifecycle Management > Journal Rules | ExchangeOnline:JournalRule |
Client Secret |
Teams
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Teams Policies & Settings | Meetings > Meeting Settings | Teams:CsTeamsMeetingConfiguration |
Client Secret |
SharePoint Online
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| SharePoint Tenant Settings | Settings | MSGraph:Admin:Sharepoint:Settings |
Client Secret |
Microsoft 365 Admin Center
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Tenant Domains | Domains | MSGraph:Domains |
Client Secret |
| Tenant Domains | Domains > Federation Configuration | MSGraph:Domains:FederationConfiguration |
Client Secret |
Azure
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Azure Resource Foundation | Resource Groups | AzureManagement:Subscriptions:ResourceGroups |
Client Secret |
| Azure Resource Foundation | Resource Groups > Storage Accounts | AzureManagement:Subscriptions:ResourceGroups:Providers:Microsoft:Storage:StorageAccounts |
Client Secret |
| Customer Lockbox | Customer Lockbox for Microsoft Azure | AzureManagement:Providers:Microsoft:CustomerLockbox |
Client Secret |
Resources that require additional actions
Follow these ad-hoc instructions to make sure all resources run correctly in your tenant.
Address Lists in Exchange Online
Configuration Resilience supports three Exchange Online resources that work only after a one-time setup in each tenant:
- Address Lists
- Global Address Lists
- Offline Address Books
Required Address List role
In Exchange Online, only accounts or applications that hold the specific “Address List” role can manage address lists. This role is not included in any Microsoft standard administrator role, therefore the CoreView application registered in your tenant cannot read or change address lists by default.
This setup must be completed, otherwise backups and deployments of these three resources fail with an error stating that a command is not recognized. All other resources are unaffected.
One-time setup requirement
- Grant the CoreView application the Address Lists role in each tenant where you want to manage address lists.
- Use the PowerShell script provided by CoreView that completes the setup for you. You only need to run it once per tenant:
Configure-ExchangeAddressListsAppOnly.ps
Step-by-step procedure
- Sign in with an account that has the Exchange Administrator or Global Administrator role in the target tenant.
- Open the Microsoft Entra admin center.
- Collect the CoreView Application (client) ID.
- Open “Enterprise applications” and select the CoreView enterprise application.
- Copy the Object ID shown under Enterprise applications. Do not use the Object ID from App registrations, as it that value identifies a different object.
- Run the CoreView PowerShell script.
- Enter the Application (client) ID and Enterprise applications Object ID when prompted.
- When the authentication prompt appears, sign in with the administrator account.
- Confirm that the script reports the Address Lists role assignment as “Completed”.
- Allow 30 minutes for Exchange Online permission propagation before retrying a backup or deployment that includes address lists. If the permission is still unavailable, retry for up to 2 hours before opening a support case.