Configuration Resilience supports 124 configurations across 9 workloads. All the supported configurations use Application authentication.
Supported configurations by workload
Entra ID
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Administrative Units & Membership | Administrative Units | MSGraph:AdministrativeUnits |
Client Secret |
| Administrative Units & Membership | Administrative Units > Members | MSGraph:AdministrativeUnits:Members:Ref |
Client Secret |
| App Governance Policies | Applications > Policies | MSGraph:Policies:DefaultAppManagementPolicy |
Client Secret |
| App Governance Policies | Enterprise Applications > Claims Mapping Policies | MSGraph:Policies:ClaimsMappingPolicies |
Client Secret |
| App Governance Policies | Enterprise Applications > Consent and Permissions > Admin Consent Settings | MSGraph:Policies:AdminConsentRequestPolicy |
Client Secret |
| App Governance Policies | Enterprise Applications > Token Lifetime Policies | MSGraph:Policies:TokenLifetimePolicies |
Client Secret |
| App Registrations | App Registrations | MSGraph:Applications |
Client Secret |
| App Registrations | App Registrations > Secrets | MSGraph:Applications:PasswordCredentials |
Client Secret |
| App Registrations | App Registrations > Token Lifetime Policies | MSGraph:Applications:TokenLifetimePolicies:Ref |
Client Secret |
| Authentication & Authorization Policies | Authentication Methods > Policies | MSGraph:Policies:AuthenticationMethodsPolicy |
Client Secret |
| Authentication & Authorization Policies | Authentication Methods > Policies > Method Settings | MSGraph:Policies:AuthenticationMethodsPolicy:AuthenticationMethodConfigurations |
Client Secret |
| Authentication & Authorization Policies | Authorization Policies | MSGraph:Policies:AuthorizationPolicy |
Client Secret |
| Authentication & Authorization Policies | Device Settings | MSGraph:Policies:DeviceRegistrationPolicy |
Client Secret |
| Authentication & Authorization Policies | Organization > Certificate-based Authentication | MSGraph:Organization:CertificateBasedAuthConfiguration |
Client Secret |
| Authentication & Authorization Policies | Security > Identity Protection > Users at Risk Detected Alerts¹ | MSGraph:IdentityProtection:Settings:Notifications |
Client Secret |
| Authentication & Authorization Policies | Users > User Settings > External Users | MSGraph:Policies:AuthenticationFlowPolicy |
Client Secret |
| Conditional Access | Security > Conditional Access > Authentication Contexts | MSGraph:Identity:ConditionalAccess:AuthenticationContextClassReferences |
Client Secret |
| Conditional Access | Security > Conditional Access > Authentication Strengths | MSGraph:Identity:ConditionalAccess:AuthenticationStrength:Policies |
Client Secret |
| Conditional Access | Security > Conditional Access > Named Locations | MSGraph:Identity:ConditionalAccess:NamedLocations |
Client Secret |
| Conditional Access | Security > Conditional Access > Policies | MSGraph:Identity:ConditionalAccess:Policies |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Default Settings | MSGraph:Policies:CrossTenantAccessPolicy:Default |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Microsoft Cloud Settings | MSGraph:Policies:CrossTenantAccessPolicy |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Organizational Settings | MSGraph:Policies:CrossTenantAccessPolicy:Partners |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Organizational Settings > Identity Synchronization | MSGraph:Policies:CrossTenantAccessPolicy:Partners:IdentitySynchronization |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:DirectoryRoles |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:RoleManagement:Directory:RoleAssignments |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:RoleManagement:Directory:RoleDefinitions |
Client Secret |
| Enterprise Applications | Enterprise Applications | MSGraph:ServicePrincipals |
Client Secret |
| Group Membership | Groups > Members | MSGraph:Groups:Members:Ref |
Client Secret |
| Groups | Groups | MSGraph:Groups |
Client Secret |
| Groups | Groups > Expiration | MSGraph:GroupLifecyclePolicies |
Client Secret |
| Groups | Groups > Expiration | MSGraph:Groups:GroupLifecyclePolicies |
Client Secret |
| Groups | Groups > Owners | MSGraph:Groups:Owners:Ref |
Client Secret |
| Identity Governance | Conditional Access > Terms of Use | MSGraph:Agreements |
Client Secret |
| Identity Governance | Identity Governance > Access Reviews | MSGraph:IdentityGovernance:AccessReviews:Definitions |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations > External Sponsors | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations:ExternalSponsors:Ref |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations > Internal Sponsors | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations:InternalSponsors:Ref |
Client Secret |
| Licenses | Licenses > All Products | MSGraph:Licenses:Assignments |
Client Secret |
| Organization, Branding & Directory Settings | Company Branding | MSGraph:Organization |
Client Secret |
| Organization, Branding & Directory Settings | Company Branding > Localizations | MSGraph:Organization:Branding:Localizations |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes | MSGraph:Directory:AttributeSets |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes | MSGraph:Directory:CustomSecurityAttributeDefinitions |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes > Allowed Values | MSGraph:Directory:CustomSecurityAttributeDefinitions:AllowedValues |
Client Secret |
| Organization, Branding & Directory Settings | Directory Settings | MSGraph:Settings |
Client Secret |
| Organization, Branding & Directory Settings | Enterprise Applications > Home Realm Discovery Policies | MSGraph:ServicePrincipals:HomeRealmDiscoveryPolicies:Ref |
Client Secret |
| Organization, Branding & Directory Settings | Feature Rollout | MSGraph:Policies:FeatureRolloutPolicies |
Client Secret |
| Organization, Branding & Directory Settings | Feature Rollout > Applies to | MSGraph:Policies:FeatureRolloutPolicies:AppliesTo:Ref |
Client Secret |
| Organization, Branding & Directory Settings | Home Realm Discovery Policies | MSGraph:Policies:HomeRealmDiscoveryPolicies |
Client Secret |
| PIM | Privileged Identity Management > Entra Roles > Assignments (Active) | MSGraph:RoleManagement:Directory:RoleAssignmentSchedules |
Client Secret |
| PIM | Privileged Identity Management > Entra Roles > Assignments (Eligible) | MSGraph:RoleManagement:Directory:RoleEligibilitySchedules |
Client Secret |
| PIM | Privileged Identity Management > Policies and Rules | MSGraph:Policies:RoleManagementPolicies |
Client Secret |
| PIM | Privileged Identity Management > Policies and Rules > Rules | MSGraph:Policies:RoleManagementPolicies:Rules |
Client Secret |
| Users | Users | MSGraph:Users |
Client Secret |
¹ The only editable field for this configuration is the value: isRiskyUsersAlertsRecipient : true/false
Intune
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| App Protection Policies | Apps > App Protection Policies (Platform = Android) | MSGraph:DeviceAppManagement:AndroidManagedAppProtections |
Client Secret |
| App Protection Policies | Apps > App Protection Policies (Platform = iOS/iPadOS) | MSGraph:DeviceAppManagement:IosManagedAppProtections |
Client Secret |
| App Protection Policies | Apps > App Protection Policies (Platform = Windows 10) | MSGraph:DeviceAppManagement:MdmWindowsInformationProtectionPolicies |
Client Secret |
| Configuration Policies (Settings Catalog) | Devices > Configuration Profiles (Settings Catalog) | MSGraph:DeviceManagement:ConfigurationPolicies |
Client Secret |
| Configuration Policies (Settings Catalog) | Endpoint Security > Firewall > Reusable Settings | MSGraph:DeviceManagement:ReusablePolicySettings |
Client Secret |
| Configuration Policies (Settings Catalog) | Endpoint Security > Security Baselines | MSGraph:DeviceManagement:Templates |
Client Secret |
| Device Compliance Policies | Devices > Compliance > Policies | MSGraph:DeviceManagement:DeviceCompliancePolicies |
Client Secret |
| Device Compliance Policies | Devices > Compliance > Scripts | MSGraph:DeviceManagement:DeviceComplianceScripts |
Client Secret |
| Device Compliance Policies | Devices > Compliance Policies > Compliance Policy Settings | MSGraph:DeviceManagement |
Client Secret |
| Device Configuration Profiles | Devices > Configuration Profiles | MSGraph:Policies:AuthenticationMethodsPolicy |
Client Secret |
| Device Configuration Profiles | Devices > Configuration Profiles > Assignments | MSGraph:Policies:AuthenticationMethodsPolicy:AuthenticationMethodConfigurations |
Client Secret |
| Endpoint Security Intents | Endpoint Security | MSGraph:DeviceManagement:Intents |
Client Secret |
| Endpoint Security Intents | Endpoint Security > Settings | MSGraph:DeviceManagement:Intents:Settings |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Import ADMX) | MSGraph:DeviceManagement:GroupPolicyUploadedDefinitionFiles |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) | MSGraph:DeviceManagement:GroupPolicyConfigurations |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) | MSGraph:DeviceManagement:GroupPolicyDefinitions |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) > Assignments | MSGraph:DeviceManagement:GroupPolicyConfigurations:Assignments |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) > Definition Values | MSGraph:DeviceManagement:GroupPolicyConfigurations:DefinitionValues |
Client Secret |
| Intune – Delegated Auth Settings | Apps > App Configuration Policies | MSGraph:Identity:ConditionalAccess:NamedLocations |
Client Secret |
| Intune – Delegated Auth Settings | Devices > Enrollment Restrictions | MSGraph:Identity:ConditionalAccess:Policies |
Client Secret |
| Intune – Delegated Auth Settings | Reports > Endpoint Analytics > Proactive Remediations | MSGraph:Policies:CrossTenantAccessPolicy:Default |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Compliance Policies > Notifications | MSGraph:DeviceManagement:NotificationMessageTemplates |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Compliance Policies > Notifications > Localized Notification Messages | MSGraph:DeviceManagement:NotificationMessageTemplates:LocalizedNotificationMessages |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Feature Updates for Windows 10 and Later | MSGraph:DeviceManagement:WindowsFeatureUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Quality Updates for Windows 10 and Later | MSGraph:DeviceManagement:WindowsQualityUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Autopilot Deployment Profiles | MSGraph:DeviceManagement:WindowsAutopilotDeploymentProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Autopilot Deployment Profiles > Assignments | MSGraph:DeviceManagement:WindowsAutopilotDeploymentProfiles:Assignments |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Updates > Driver Updates | MSGraph:DeviceManagement:WindowsDriverUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Filters | MSGraph:DeviceManagement:AssignmentFilters |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles | MSGraph:DeviceManagement:RoleDefinitions |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Role Assignments | MSGraph:DeviceManagement:RoleDefinitions:RoleAssignments |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Scope Tags | MSGraph:DeviceManagement:RoleScopeTags |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Scope Tags > Assignments | MSGraph:DeviceManagement:RoleScopeTags:Assignments |
Client Secret |
| Mobile Apps & App Configuration | Apps | MSGraph:DeviceAppManagement:MobileApps |
Client Secret |
| Mobile Apps & App Configuration | Apps | MSGraph:DeviceAppManagement:MobileApps:Assignments |
Client Secret |
| Mobile Apps & App Configuration | Apps > App Configuration Policies | MSGraph:DeviceAppManagement:MobileAppConfigurations |
Client Secret |
| Mobile Apps & App Configuration | Policy Sets | MSGraph:DeviceAppManagement:PolicySets |
Client Secret |
| Scripts & Proactive Remediations | Devices > Scripts | MSGraph:DeviceManagement:DeviceManagementScripts |
Client Secret |
| Scripts & Proactive Remediations | Devices > Scripts | MSGraph:DeviceManagement:DeviceShellScripts |
Client Secret |
Exchange Online
Note: to correctly manage Address Lists, Global Access Lists and Offline Address Books, manual setups may be required.
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Distribution Group Members | Distribution Groups > Members | ExchangeOnline:DistributionGroupMember |
Client Secret |
| Exchange Mail Flow & Client Access | Availability Address Spaces | MSGraph:DeviceAppManagement:IosManagedAppProtections |
Client Secret |
| Exchange Mail Flow & Client Access | Availability Config | MSGraph:DeviceAppManagement:MdmWindowsInformationProtectionPolicies |
Client Secret |
| Exchange Mail Flow & Client Access | Mobile Device Access > Device Access Rules | ExchangeOnline:ActiveSyncDeviceAccessRule |
Client Secret |
| Exchange Mail Flow & Client Access | Mobile Device Mailbox Policies | ExchangeOnline:MobileDeviceMailboxPolicy |
Client Secret |
| Exchange Mail Flow & Client Access | Partner Applications | ExchangeOnline:PartnerApplication |
Client Secret |
| Exchange Mail Flow & Client Access | Policy Tip Config | ExchangeOnline:PolicyTipConfig |
Client Secret |
| Exchange Mail Flow & Client Access | Transport Rules | ExchangeOnline:TransportRule |
Client Secret |
| Exchange Recipients & Address Book | Distribution Groups | ExchangeOnline:DistributionGroup |
Client Secret |
| Exchange Recipients & Address Book | Dynamic Distribution Groups | ExchangeOnline:DynamicDistributionGroup |
Client Secret |
| Exchange Recipients & Address Book | Mail Flow > Accepted Domains | ExchangeOnline:AcceptedDomain |
Client Secret |
| Exchange Role Groups | Role Groups | ExchangeOnline:RoleGroup |
Client Secret |
| Exchange Role Groups | Role Groups > Members | ExchangeOnline:RoleGroupMember |
Client Secret |
| Mailbox Permissions | Mailboxes > Permissions | ExchangeOnline:MailboxPermission |
Client Secret |
| Mailboxes | Mailboxes | ExchangeOnline:Mailbox |
Client Secret |
Defender
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Anti-phishing | ExchangeOnline:AntiPhishRule |
Client Secret |
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Safe Attachments | ExchangeOnline:SafeAttachmentRule |
Client Secret |
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Safe Links | ExchangeOnline:SafeLinksRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedContentFilterPolicy |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedContentFilterRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedOutboundSpamFilterRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Policies & Rules > Threat Policies > Email Authentication Settings | ExchangeOnline:DkimSigningConfig |
Client Secret |
| Defender – Device Policies & Hunting | Configuration Management > Device Configuration | Defender:DevicePolicies |
Client Secret |
| Defender – Device Policies & Hunting | Hunting > Advanced Hunting > Queries > Shared Queries | Defender:HuntingService:Queries |
Client Secret |
Purview
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Purview – Retention & Records | Data Lifecycle Management > Exchange (legacy) > MRM Retention Tags | ExchangeOnline:RetentionPolicyTag |
Client Secret |
| Purview – Retention & Records | Data Lifecycle Management > Journal Rules | ExchangeOnline:JournalRule |
Client Secret |
Teams
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Teams Policies & Settings | Meetings > Meeting Settings | Teams:CsTeamsMeetingConfiguration |
Client Secret |
SharePoint Online
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| SharePoint Tenant Settings | Settings | MSGraph:Admin:Sharepoint:Settings |
Client Secret |
Microsoft 365 Admin Center
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Tenant Domains | Domains | MSGraph:Domains |
Client Secret |
| Tenant Domains | Domains > Federation Configuration | MSGraph:Domains:FederationConfiguration |
Client Secret |
Azure
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Customer Lockbox | Customer Lockbox for Microsoft Azure | AzureManagement:Providers:Microsoft:CustomerLockbox |
Client Secret |
Configurations requiring tenant-specific setup
Complete the tenant-specific role assignments described below before managing these additional resources in Configuration Resilience.
Address Lists in Exchange Online
Configuration Resilience requires a one-time Exchange Online Address Lists role assignment for the following resource types:
- Address Lists
- Global Address Lists
- Offline Address Books
Without this role assignment, Exchange Online cannot authorize the address-list management cmdlets used for these resource types. Resources outside this list do not require this role assignment.
One-time setup
- Assign the Address Lists role to the CoreView Configuration Manager App in each tenant where you manage address lists.
- Run the CoreView PowerShell script to assign the Exchange Online Address Lists role to the CoreView enterprise application. Run the script once for each tenant:
Configure-ExchangeAddressListsAppOnly.ps
Assign the Address Lists role
- Sign in to the target tenant with an account assigned the Exchange Administrator or Global Administrator role.
- Open the Microsoft Entra admin center.
- Open Enterprise applications and select the CoreView Configuration Manager App.
- In the application’s Overview page, copy the value in the Application (client) ID field.
- Copy the Object ID displayed for the Configuration Manager App. Do not use the Object ID from App registrations because it identifies a different directory object.
- Run the CoreView PowerShell script.
- When prompted, enter the Application (client) ID and the Configuration Manager App Object ID.
- When prompted to authenticate, sign in with the administrator account.
- Verify that the script reports the Address Lists role assignment as Completed.
- Wait for Exchange Online to apply the role assignment before retrying a backup or deployment that includes address lists. Follow the retry guidance in the CoreView script documentation.