This article lists the Microsoft 365 configurations protected by Configuration Resilience. All the supported configurations use Application authentication.
License requirements
Some Microsoft 365 configurations are available only with a specific license. Before onboarding a tenant, check that it has the licenses listed in this section.
If the tenant doesn’t have a required license, Configuration Resilience skips only the configurations that depend on it. Other configurations in the same workload are still protected.
Adding a license doesn’t create the configurations. After the license is active, create the configurations in the tenant, then run a new backup.
Required licenses by workload
Entra ID
| License needed | Configurations covered |
|---|---|
| Microsoft Entra ID Free | All configurations not listed below. |
| Microsoft Entra ID P1 | Conditional Access policies. |
| Microsoft Entra ID P2 | Conditional Access policies that use sign-in risk or user risk. |
| Microsoft Entra ID P2 | Identity Protection alerts (Users at Risk Detected Alerts). |
| Microsoft Entra ID P2 or Microsoft Entra ID Governance | Privileged Identity Management (assignments, policies and rules). |
| Microsoft Entra ID P2 or Microsoft Entra ID Governance | Access reviews. |
| Microsoft Entra ID Governance | Connected organizations. Some entitlement management capabilities also work with Microsoft Entra ID P2. |
Intune
| License needed | Configurations covered |
|---|---|
| Microsoft Intune Plan 1 | All configurations |
Exchange Online
| License needed | Configurations covered |
|---|---|
| Exchange Online Plan 1 | All configurations |
Defender
| License needed | Configurations covered |
|---|---|
| Exchange Online | Anti-spam. |
| Exchange Online | DKIM. |
| Exchange Online | Anti-phishing. |
| Microsoft Defender for Office 365 Plan 1 | Safe Links. |
| Microsoft Defender for Office 365 Plan 1 | Safe Attachments. |
| Microsoft Defender for Office 365 Plan 1 | Anti-phishing impersonation settings. |
| Microsoft Defender for Endpoint Plan 2 | Device policies. |
| Microsoft Defender for Endpoint Plan 2 | Advanced hunting. |
| Microsoft Defender for Endpoint Plan 2 | Defender XDR email notifications. |
Purview
| License needed | Configurations covered |
|---|---|
| Microsoft 365 E3 | All configurations. |
Teams
| License needed | Configurations covered |
|---|---|
| Microsoft Teams | All configurations. |
SharePoint Online
| License needed | Configurations covered |
|---|---|
| SharePoint Online | All configurations. |
Microsoft 365 Admin Center
| License needed | Configurations covered |
|---|---|
| No additional license | All configurations. |
Azure
| License needed | Configurations covered |
|---|---|
| Azure subscription | Resource groups. |
| Azure subscription | Storage accounts. |
| Azure support plan Developer or higher | Customer Lockbox for Microsoft Azure. |
Where required licenses are included
| License | Included in |
|---|---|
| Microsoft Entra ID P1 | Microsoft 365 E3, Microsoft 365 Business Premium. |
| Microsoft Entra ID P2 | Microsoft 365 E5. |
| Microsoft Entra ID Governance | Separate add-on. |
| Microsoft Intune Plan 1 | Microsoft 365 E3. |
| Exchange Online Plan 1 | Microsoft 365. |
| Microsoft Defender for Endpoint Plan 2 | Microsoft 365 E5. |
| Microsoft Teams | Most Microsoft 365 plans. |
| SharePoint Online | Microsoft 365. |
Configurations with limited actions
Microsoft APIs do not support every action for every configuration. As a result, a configuration may appear as “Unchangeable” in Configuration Resilience when the action you need is not supported. The table below shows which actions are available for each configuration.
- Update only: you can update the configuration, but you cannot add or remove it.
- Add and Remove only: you can add or remove the configuration, but you cannot update it.
- Add and Update only: you can add or update the configuration, but you cannot remove it.
- Add only: you can add the configuration, but you cannot update or remove it.
- Read only: the configuration is backed up, but you cannot add, update, or remove it.
Configurations with limited actions by workload
Entra ID
| Supported action | Configurations |
|---|---|
| Update only | Applications > Policies |
| Update only | Enterprise Applications > Consent and Permissions > Admin Consent Settings |
| Update only | Authentication Methods > Policies |
| Update only | Authentication Methods > Policies > Method Settings |
| Update only | Authorization Policies |
| Update only | Device Settings |
| Update only | Security > Identity Protection > Users at Risk Detected Alerts |
| Update only | Users > User Settings > External Users |
| Update only | External Identities > Cross-tenant Access Settings > Default Settings |
| Update only | External Identities > Cross-tenant Access Settings > Microsoft Cloud Settings |
| Update only | Company Branding |
| Update only | Privileged Identity Management > Policies and Rules > Rules |
| Add and Remove only | Administrative Units > Members |
| Add and Remove only | App Registrations > Token Lifetime Policies |
| Add and Remove only | Groups > Members |
| Add and Remove only | Groups > Expiration |
| Add and Remove only | Groups > Owners |
| Add and Remove only | Identity Governance > Connected Organizations > External Sponsors |
| Add and Remove only | Identity Governance > Connected Organizations > Internal Sponsors |
| Add and Remove only | Licenses > All Products |
| Add and Remove only | Enterprise Applications > Home Realm Discovery Policies |
| Add and Remove only | Feature Rollout > Applies to |
| Add and Update only | Custom Security Attributes |
| Add and Update only | Custom Security Attributes > Allowed Values |
| Add only | Roles and Administrators |
| Read only | App Registrations > Secrets |
| Read only | Security > Conditional Access > Authentication Strengths |
Intune
| Supported action | Configurations |
|---|---|
| Update only | Endpoint Security > Settings |
| Add and Remove only | Devices > Configuration Profiles (Profile Type = Administrative Templates) > Assignments |
| Add and Remove only | Devices > Windows Autopilot Deployment Profiles > Assignments |
| Add and Remove only | Tenant Administration > Roles > Scope Tags > Assignments |
| Add and Remove only | Apps |
| Read only | Endpoint Security > Security Baselines |
| Read only | Devices > Configuration Profiles (Import ADMX) |
| Read only | Devices > Configuration Profiles (Profile Type = Administrative Templates) |
Exchange Online
| Supported action | Configurations |
|---|---|
| Update only | Availability Config |
| Update only | Mail Flow > Accepted Domains |
| Add and Remove only | Distribution Groups > Members |
| Add and Remove only | Role Groups > Members |
| Add and Remove only | Mailboxes > Permissions |
Teams
| Supported action | Configurations |
|---|---|
| Update only | Meetings > Meeting Settings |
SharePoint Online
| Supported action | Configurations |
|---|---|
| Update only | Settings |
Microsoft 365 Admin Center
| Supported action | Configurations |
|---|---|
| Add and Update only | Domains |
Azure
| Supported action | Configurations |
|---|---|
| Update only | Customer Lockbox for Microsoft Azure |
All other configurations not listed in the table above support Add, Update and Remove.
Supported configurations by workload
Entra ID
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Administrative Units & Membership | Administrative Units | MSGraph:AdministrativeUnits |
Client Secret |
| Administrative Units & Membership | Administrative Units > Members | MSGraph:AdministrativeUnits:Members:Ref |
Client Secret |
| App Governance Policies | Applications > Policies | MSGraph:Policies:DefaultAppManagementPolicy |
Client Secret |
| App Governance Policies | Enterprise Applications > Claims Mapping Policies | MSGraph:Policies:ClaimsMappingPolicies |
Client Secret |
| App Governance Policies | Enterprise Applications > Consent and Permissions > Admin Consent Settings | MSGraph:Policies:AdminConsentRequestPolicy |
Client Secret |
| App Governance Policies | Enterprise Applications > Token Lifetime Policies | MSGraph:Policies:TokenLifetimePolicies |
Client Secret |
| App Registrations | App Registrations | MSGraph:Applications |
Client Secret |
| App Registrations | App Registrations > Secrets | MSGraph:Applications:PasswordCredentials |
Client Secret |
| App Registrations | App Registrations > Token Lifetime Policies | MSGraph:Applications:TokenLifetimePolicies:Ref |
Client Secret |
| Authentication & Authorization Policies | Authentication Methods > Policies | MSGraph:Policies:AuthenticationMethodsPolicy |
Client Secret |
| Authentication & Authorization Policies | Authentication Methods > Policies > Method Settings | MSGraph:Policies:AuthenticationMethodsPolicy:AuthenticationMethodConfigurations |
Client Secret |
| Authentication & Authorization Policies | Authorization Policies | MSGraph:Policies:AuthorizationPolicy |
Client Secret |
| Authentication & Authorization Policies | Device Settings | MSGraph:Policies:DeviceRegistrationPolicy |
Client Secret |
| Authentication & Authorization Policies | Organization > Certificate-based Authentication | MSGraph:Organization:CertificateBasedAuthConfiguration |
Client Secret |
| Authentication & Authorization Policies | Security > Identity Protection > Users at Risk Detected Alerts¹ | MSGraph:IdentityProtection:Settings:Notifications |
Client Secret |
| Authentication & Authorization Policies | Users > User Settings > External Users | MSGraph:Policies:AuthenticationFlowPolicy |
Client Secret |
| Conditional Access | Security > Conditional Access > Authentication Contexts | MSGraph:Identity:ConditionalAccess:AuthenticationContextClassReferences |
Client Secret |
| Conditional Access | Security > Conditional Access > Authentication Strengths | MSGraph:Identity:ConditionalAccess:AuthenticationStrength:Policies |
Client Secret |
| Conditional Access | Security > Conditional Access > Named Locations | MSGraph:Identity:ConditionalAccess:NamedLocations |
Client Secret |
| Conditional Access | Security > Conditional Access > Policies | MSGraph:Identity:ConditionalAccess:Policies |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Default Settings | MSGraph:Policies:CrossTenantAccessPolicy:Default |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Microsoft Cloud Settings | MSGraph:Policies:CrossTenantAccessPolicy |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Organizational Settings | MSGraph:Policies:CrossTenantAccessPolicy:Partners |
Client Secret |
| Cross-Tenant Access | External Identities > Cross-tenant Access Settings > Organizational Settings > Identity Synchronization | MSGraph:Policies:CrossTenantAccessPolicy:Partners:IdentitySynchronization |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:DirectoryRoles |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:RoleManagement:Directory:RoleAssignments |
Client Secret |
| Directory Roles & Assignments | Roles and Administrators | MSGraph:RoleManagement:Directory:RoleDefinitions |
Client Secret |
| Enterprise Applications | Enterprise Applications | MSGraph:ServicePrincipals |
Client Secret |
| Group Membership | Groups > Members | MSGraph:Groups:Members:Ref |
Client Secret |
| Groups | Groups | MSGraph:Groups |
Client Secret |
| Groups | Groups > Expiration | MSGraph:GroupLifecyclePolicies |
Client Secret |
| Groups | Groups > Expiration | MSGraph:Groups:GroupLifecyclePolicies |
Client Secret |
| Groups | Groups > Owners | MSGraph:Groups:Owners:Ref |
Client Secret |
| Identity Governance | Conditional Access > Terms of Use | MSGraph:Agreements |
Client Secret |
| Identity Governance | Identity Governance > Access Reviews | MSGraph:IdentityGovernance:AccessReviews:Definitions |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations > External Sponsors | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations:ExternalSponsors:Ref |
Client Secret |
| Identity Governance | Identity Governance > Connected Organizations > Internal Sponsors | MSGraph:IdentityGovernance:EntitlementManagement:ConnectedOrganizations:InternalSponsors:Ref |
Client Secret |
| Licenses | Licenses > All Products | MSGraph:Licenses:Assignments |
Client Secret |
| Organization, Branding & Directory Settings | Company Branding | MSGraph:Organization |
Client Secret |
| Organization, Branding & Directory Settings | Company Branding > Localizations | MSGraph:Organization:Branding:Localizations |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes | MSGraph:Directory:AttributeSets |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes | MSGraph:Directory:CustomSecurityAttributeDefinitions |
Client Secret |
| Organization, Branding & Directory Settings | Custom Security Attributes > Allowed Values | MSGraph:Directory:CustomSecurityAttributeDefinitions:AllowedValues |
Client Secret |
| Organization, Branding & Directory Settings | Directory Settings | MSGraph:Settings |
Client Secret |
| Organization, Branding & Directory Settings | Enterprise Applications > Home Realm Discovery Policies | MSGraph:ServicePrincipals:HomeRealmDiscoveryPolicies:Ref |
Client Secret |
| Organization, Branding & Directory Settings | Feature Rollout | MSGraph:Policies:FeatureRolloutPolicies |
Client Secret |
| Organization, Branding & Directory Settings | Feature Rollout > Applies to | MSGraph:Policies:FeatureRolloutPolicies:AppliesTo:Ref |
Client Secret |
| Organization, Branding & Directory Settings | Home Realm Discovery Policies | MSGraph:Policies:HomeRealmDiscoveryPolicies |
Client Secret |
| PIM | Privileged Identity Management > Entra Roles > Assignments (Active) | MSGraph:RoleManagement:Directory:RoleAssignmentSchedules |
Client Secret |
| PIM | Privileged Identity Management > Entra Roles > Assignments (Eligible) | MSGraph:RoleManagement:Directory:RoleEligibilitySchedules |
Client Secret |
| PIM | Privileged Identity Management > Policies and Rules | MSGraph:Policies:RoleManagementPolicies |
Client Secret |
| PIM | Privileged Identity Management > Policies and Rules > Rules | MSGraph:Policies:RoleManagementPolicies:Rules |
Client Secret |
| Users | Users | MSGraph:Users |
Client Secret |
¹ The only editable field for this configuration is the value: isRiskyUsersAlertsRecipient : true/false
Intune
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| App Protection Policies | Apps > App Protection Policies (Platform = Android) | MSGraph:DeviceAppManagement:AndroidManagedAppProtections |
Client Secret |
| App Protection Policies | Apps > App Protection Policies (Platform = iOS/iPadOS) | MSGraph:DeviceAppManagement:IosManagedAppProtections |
Client Secret |
| App Protection Policies | Apps > App Protection Policies (Platform = Windows 10) | MSGraph:DeviceAppManagement:MdmWindowsInformationProtectionPolicies |
Client Secret |
| Configuration Policies (Settings Catalog) | Devices > Configuration Profiles (Settings Catalog) | MSGraph:DeviceManagement:ConfigurationPolicies |
Client Secret |
| Configuration Policies (Settings Catalog) | Endpoint Security > Firewall > Reusable Settings | MSGraph:DeviceManagement:ReusablePolicySettings |
Client Secret |
| Configuration Policies (Settings Catalog) | Endpoint Security > Security Baselines | MSGraph:DeviceManagement:Templates |
Client Secret |
| Device Compliance Policies | Devices > Compliance > Policies | MSGraph:DeviceManagement:DeviceCompliancePolicies |
Client Secret |
| Device Compliance Policies | Devices > Compliance > Scripts | MSGraph:DeviceManagement:DeviceComplianceScripts |
Client Secret |
| Device Compliance Policies | Devices > Compliance Policies > Compliance Policy Settings | MSGraph:DeviceManagement |
Client Secret |
| Device Configuration Profiles | Devices > Configuration Profiles | MSGraph:Policies:AuthenticationMethodsPolicy |
Client Secret |
| Device Configuration Profiles | Devices > Configuration Profiles > Assignments | MSGraph:Policies:AuthenticationMethodsPolicy:AuthenticationMethodConfigurations |
Client Secret |
| Endpoint Security Intents | Endpoint Security | MSGraph:DeviceManagement:Intents |
Client Secret |
| Endpoint Security Intents | Endpoint Security > Settings | MSGraph:DeviceManagement:Intents:Settings |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Import ADMX) | MSGraph:DeviceManagement:GroupPolicyUploadedDefinitionFiles |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) | MSGraph:DeviceManagement:GroupPolicyConfigurations |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) | MSGraph:DeviceManagement:GroupPolicyDefinitions |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) > Assignments | MSGraph:DeviceManagement:GroupPolicyConfigurations:Assignments |
Client Secret |
| Group Policy Configurations | Devices > Configuration Profiles (Profile Type = Administrative Templates) > Definition Values | MSGraph:DeviceManagement:GroupPolicyConfigurations:DefinitionValues |
Client Secret |
| Intune – Delegated Auth Settings | Apps > App Configuration Policies | MSGraph:Identity:ConditionalAccess:NamedLocations |
Client Secret |
| Intune – Delegated Auth Settings | Devices > Enrollment Restrictions | MSGraph:Identity:ConditionalAccess:Policies |
Client Secret |
| Intune – Delegated Auth Settings | Reports > Endpoint Analytics > Proactive Remediations | MSGraph:Policies:CrossTenantAccessPolicy:Default |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Compliance Policies > Notifications | MSGraph:DeviceManagement:NotificationMessageTemplates |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Compliance Policies > Notifications > Localized Notification Messages | MSGraph:DeviceManagement:NotificationMessageTemplates:LocalizedNotificationMessages |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Feature Updates for Windows 10 and Later | MSGraph:DeviceManagement:WindowsFeatureUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Quality Updates for Windows 10 and Later | MSGraph:DeviceManagement:WindowsQualityUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Autopilot Deployment Profiles | MSGraph:DeviceManagement:WindowsAutopilotDeploymentProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Autopilot Deployment Profiles > Assignments | MSGraph:DeviceManagement:WindowsAutopilotDeploymentProfiles:Assignments |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Devices > Windows Updates > Driver Updates | MSGraph:DeviceManagement:WindowsDriverUpdateProfiles |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Filters | MSGraph:DeviceManagement:AssignmentFilters |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles | MSGraph:DeviceManagement:RoleDefinitions |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Role Assignments | MSGraph:DeviceManagement:RoleDefinitions:RoleAssignments |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Scope Tags | MSGraph:DeviceManagement:RoleScopeTags |
Client Secret |
| Intune Platform (RBAC, Enrollment & Updates) | Tenant Administration > Roles > Scope Tags > Assignments | MSGraph:DeviceManagement:RoleScopeTags:Assignments |
Client Secret |
| Mobile Apps & App Configuration | Apps | MSGraph:DeviceAppManagement:MobileApps |
Client Secret |
| Mobile Apps & App Configuration | Apps | MSGraph:DeviceAppManagement:MobileApps:Assignments |
Client Secret |
| Mobile Apps & App Configuration | Apps > App Configuration Policies | MSGraph:DeviceAppManagement:MobileAppConfigurations |
Client Secret |
| Mobile Apps & App Configuration | Policy Sets | MSGraph:DeviceAppManagement:PolicySets |
Client Secret |
| Scripts & Proactive Remediations | Devices > Scripts | MSGraph:DeviceManagement:DeviceManagementScripts |
Client Secret |
| Scripts & Proactive Remediations | Devices > Scripts | MSGraph:DeviceManagement:DeviceShellScripts |
Client Secret |
Exchange Online
Note: to correctly manage Address Lists, Global Access Lists and Offline Address Books, manual setups may be required.
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Distribution Group Members | Distribution Groups > Members | ExchangeOnline:DistributionGroupMember |
Client Secret |
| Exchange Mail Flow & Client Access | Availability Address Spaces | MSGraph:DeviceAppManagement:IosManagedAppProtections |
Client Secret |
| Exchange Mail Flow & Client Access | Availability Config | MSGraph:DeviceAppManagement:MdmWindowsInformationProtectionPolicies |
Client Secret |
| Exchange Mail Flow & Client Access | Mobile Device Access > Device Access Rules | ExchangeOnline:ActiveSyncDeviceAccessRule |
Client Secret |
| Exchange Mail Flow & Client Access | Mobile Device Mailbox Policies | ExchangeOnline:MobileDeviceMailboxPolicy |
Client Secret |
| Exchange Mail Flow & Client Access | Partner Applications | ExchangeOnline:PartnerApplication |
Client Secret |
| Exchange Mail Flow & Client Access | Policy Tip Config | ExchangeOnline:PolicyTipConfig |
Client Secret |
| Exchange Mail Flow & Client Access | Transport Rules | ExchangeOnline:TransportRule |
Client Secret |
| Exchange Recipients & Address Book | Distribution Groups | ExchangeOnline:DistributionGroup |
Client Secret |
| Exchange Recipients & Address Book | Dynamic Distribution Groups | ExchangeOnline:DynamicDistributionGroup |
Client Secret |
| Exchange Recipients & Address Book | Mail Flow > Accepted Domains | ExchangeOnline:AcceptedDomain |
Client Secret |
| Exchange Role Groups | Role Groups | ExchangeOnline:RoleGroup |
Client Secret |
| Exchange Role Groups | Role Groups > Members | ExchangeOnline:RoleGroupMember |
Client Secret |
| Mailbox Permissions | Mailboxes > Permissions | ExchangeOnline:MailboxPermission |
Client Secret |
| Mailboxes | Mailboxes | ExchangeOnline:Mailbox |
Client Secret |
Defender
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Anti-phishing | ExchangeOnline:AntiPhishRule |
Client Secret |
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Safe Attachments | ExchangeOnline:SafeAttachmentRule |
Client Secret |
| Defender – Anti-Phish & Safe Links/Attach. | Email & Collaboration > Policies > Safe Links | ExchangeOnline:SafeLinksRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedContentFilterPolicy |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedContentFilterRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Email & Collaboration > Policies > Anti-spam | ExchangeOnline:HostedOutboundSpamFilterRule |
Client Secret |
| Defender – Anti-Spam, Malware & Email Auth | Policies & Rules > Threat Policies > Email Authentication Settings | ExchangeOnline:DkimSigningConfig |
Client Secret |
| Defender – Device Policies & Hunting | Configuration Management > Device Configuration | Defender:DevicePolicies |
Client Secret |
| Defender – Device Policies & Hunting | Hunting > Advanced Hunting > Queries > Shared Queries | Defender:HuntingService:Queries |
Client Secret |
Purview
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Purview – Retention & Records | Data Lifecycle Management > Exchange (legacy) > MRM Retention Tags | ExchangeOnline:RetentionPolicyTag |
Client Secret |
| Purview – Retention & Records | Data Lifecycle Management > Journal Rules | ExchangeOnline:JournalRule |
Client Secret |
Teams
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Teams Policies & Settings | Meetings > Meeting Settings | Teams:CsTeamsMeetingConfiguration |
Client Secret |
SharePoint Online
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| SharePoint Tenant Settings | Settings | MSGraph:Admin:Sharepoint:Settings |
Client Secret |
Microsoft 365 Admin Center
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Tenant Domains | Domains | MSGraph:Domains |
Client Secret |
| Tenant Domains | Domains > Federation Configuration | MSGraph:Domains:FederationConfiguration |
Client Secret |
Azure
| Scope | Configuration | Directory | Auth method |
|---|---|---|---|
| Customer Lockbox | Customer Lockbox for Microsoft Azure | AzureManagement:Providers:Microsoft:CustomerLockbox |
Client Secret |
Configurations requiring tenant-specific setup
Complete the tenant-specific role assignments described below before managing these additional configurations in Configuration Resilience.
Address Lists in Exchange Online
Configuration Resilience requires a one-time Exchange Online Address Lists role assignment for the following resource types:
- Address Lists
- Global Address Lists
- Offline Address Books
Without this role assignment, Exchange Online cannot authorize the address-list management cmdlets used for these resource types. Resources outside this list do not require this role assignment.
One-time setup
- Assign the Address Lists role to the CoreView Configuration Manager App in each tenant where you manage address lists.
- Run the CoreView PowerShell script to assign the Exchange Online Address Lists role to the CoreView enterprise application. Run the script once for each tenant:
Configure-ExchangeAddressListsAppOnly.ps
Assign the Address Lists role
- Sign in to the target tenant with an account assigned the Exchange Administrator or Global Administrator role.
- Open the Microsoft Entra admin center.
- Open Enterprise applications and select the CoreView Configuration Manager App.
- In the application’s Overview page, copy the value in the Application (client) ID field.
- Copy the Object ID displayed for the Configuration Manager App. Do not use the Object ID from App registrations because it identifies a different directory object.
- Run the CoreView PowerShell script.
- When prompted, enter the Application (client) ID and the Configuration Manager App Object ID.
- When prompted to authenticate, sign in with the administrator account.
- Verify that the script reports the Address Lists role assignment as “Completed”.
- Wait for Exchange Online to apply the role assignment before retrying a backup or deployment that includes address lists. Follow the retry guidance in the CoreView script documentation.