Before exploring Configuration Resilience, it is essential to understand the following key concepts:
Target tenant
The target tenant is the tenant where a deployment is applied. It is always the tenant you are signed in to, which is the tenant selected under “Managed tenants” in the top bar. To deploy configurations to a different tenant, select that tenant first.
Deploy status
Configuration Resilience shows you the Deploy status of the target tenant, which tells you whether the tenant can receive a new Deploy and, if not, why.
| Status | Description |
|---|---|
| Ready | The tenant can receive a new Deploy. |
| Pending approval | A Deploy has been submitted and is waiting for approval by a Configuration Admin. |
| Running deploy | Configuration Resilience is sending the configuration changes to Microsoft 365. |
| Propagating | The Deploy is complete. Configuration Resilience has sent all changes to Microsoft 365 and recorded the deployment in Deploy history. Microsoft 365 is still applying the changes with eventual consistency, so they may take some time to appear in the tenant. |
Only one Deploy can be active on a tenant at a time: a new Deploy can start only when the status is Ready.
Eventual consistency
Microsoft 365 processes some configuration changes asynchronously, so they may not appear immediately in Configuration Resilience.
When the target tenant status shows Propagating, the deployment is complete, but Microsoft 365 is still applying the changes. Configuration Resilience may continue to show the previous value until the updated data is available; alignment status may update after the next scheduled backup or synchronization cycle.
A completed Deploy means the deployment step has finished—not that every change is already visible in the tenant. For more information, see Understand propagation after a Deploy.
Baseline
A baseline is a fixed, point-in-time set of configuration states that represents the security standard defined by a recognized framework or industry benchmark.
Unlike a real tenant, a baseline is not a live environment. It is a static reference model. Its configuration values are locked and do not drift over time because they represent what the framework defines as the expected secure state.
The baseline is used as a benchmark. The tenant’s configuration values are compared against it to identify gaps, deviations, and areas of non-compliance.
For the full list of baselines available in Configuration Resilience, see Available baselines.
How configurations are organized
Configuration Resilience organizes tenant configurations from broadest to most specific: workload, scope, configuration type, configuration, and property.
Workload
Microsoft 365 service area used to group related configurations, such as Teams, SharePoint, and Entra ID. Each workload contains one or more scopes.
Scope
A group of related configuration types within a workload, such as Users, Groups, Licenses, or Tenant Domains. Scopes let you monitor related configurations together as a single area. Each scope contains one or more configuration types.
Configuration type
A group of configurations of the same kind, such as Conditional Access Policies or Compliance Policies.
Configuration types align with the Microsoft APIs that Configuration Resilience uses to read and deploy configurations. As a result, settings shown together on a Microsoft 365 admin center page may belong to different configuration types. Configuration Resilience groups related configuration types into a single scope.
(Individual) Configuration
An individual item within a configuration type, made up of one or more properties that define its behavior.
(Configuration) Name
The configuration name reflects how the configuration appears in your Microsoft 365 tenant: it may be a name defined by your administrators or a default name assigned by Microsoft.
For example, within the Meeting Policies Configuration Type, Global (Org-wide default) is a configuration with a default name. It is the meeting policy that Microsoft Teams automatically applies to all users in the organization, unless they are assigned a different policy.
(Configuration) Property
A specific setting or attribute that defines part of a configuration's behavior. Each configuration is made up of one or more properties.
Each property consists of:
- A property name, which identifies the setting.
- A property value, which is the value currently assigned to it. Values can be of different types, such as Boolean (true/false), text, numbers, or lists.
For example, the Global (Org-wide default) meeting policy includes a property called AllowCloudRecording, which determines whether users can record meetings. If its value is True, users can record meetings; if it is False, they cannot.
Skipped
Skipped is a status that warns you that an operation did not complete successfully. It can apply to either a Backup or a Deploy.
- Skipped backup: Configuration Resilience could not retrieve the current state of one or more configurations. It is shown with a yellow warning icon. Until the next scheduled backup completes successfully, you cannot open the affected configurations at property level, because their property data is unavailable or may be out of date. The status clears automatically once the next backup completes.
- Skipped deploy: Configuration Resilience could not change one or more configurations as requested. A banner shows a possible explanation of what caused the error.
If the error persists, contact CoreView Support and include the Operation ID. You can find it in the Details section of Change history (for a backup) or of Deploy history (for a deploy).
Backup frequency
Configuration Resilience continuously monitors your configurations and backs up each scope at regular intervals. The backup frequency is set by CoreView and cannot be changed. This helps keep requests within Microsoft’s service limits and reduces the risk of backups being delayed or blocked by API throttling.
If an issue or specific need arises, CoreView Support can exceptionally run a backup outside the automatic schedule.
Unchangeable configurations
Some configurations may be marked as Unchangeable when Microsoft does not support the action required to align them. In some cases, a configuration can be updated, added, or removed. In other cases, only one or two actions are supported.
Dependencies
Some configurations are marked as Dependencies because other configurations or objects, such as users or groups, rely on them. Review any changes carefully, as they may affect those related items.