Entra.News Dailydaily.entra.news
Aboutmerill.net
Microsoft Entra ID Governance

Configure configuration management service permissions

1 August 2026Updated+32 / −37 lines

In brief

Learn how to assign or remove the application permissions and roles that the Tenant Configuration Management service uses to create snapshots and run monitors

Documentation change

Set up permissions for tenant monitoring

This article describes how to manage the permissions that the configuration management service needs to access resources identified in a monitor. An administrator must assign these permissions manually. Two types of permissions can be managed in the Microsoft Entra admin center: application permissions and Microsoft Entra roles.

Configure configuration management service permissions

The permission type you assign depends on the services you need to monitor:

Use the Configuration management permissions page to assign or remove permissions for the Tenant Configuration Management service. The service uses these permissions to create snapshots and run monitors.

  • Microsoft Entra ID and Intune: Assign application permissions. This approach is the least-privileged way to enable monitoring. For example, to monitor conditional access policies, the configuration management service needs the Policy.Read.All application permission. If your policies reference other resource types, you might also need permissions like User.Read.All or RoleManagement.Read.All.
  • Teams: Assign the Teams Reader role. Teams doesn't have granular application permissions, so assigning the configuration management service to the Teams Reader role is the least-privileged way to enable monitoring.
  • Exchange, Security, and Compliance (Purview and Defender): Assign permissions locally within the admin experiences for those services. Built-in Microsoft Entra roles grant more permissions than needed for these monitoring scenarios.

Configure service permissions before you create snapshots or monitors that include the corresponding workload resources. Missing service permissions can cause a snapshot to be incomplete or a monitor run to fail.

When you create a monitor or snapshot, the Permissions step shows whether the service has the least-privilege permissions for the resource types you selected. This step is read-only. If the wizard shows that required least-privilege permissions are missing, use the Configuration management permissions page to add them.

Prerequisites

Open Configuration management permissions

Browse to configuration management permissions

To open the permissions page, follow these steps:

  1. Sign in to the Microsoft Entra admin center.
  2. Browse to Tenant Governance > Configuration management permissions.

Manage application permissions

To manage application permissions that the configuration management service uses to access resources:

Assign permissions

  • Select the Application permissions tab at the top of the page.

Assign permissions based on the workloads that contain the resources you want to snapshot or monitor:

Add application permissions

  • Microsoft Entra ID or Intune resources: On the Application permissions tab, add the app-only permissions for the relevant Microsoft Graph resources.
  1. Select Add permissions in the command bar.
  2. Search for and select the application permissions that the configuration management service needs to access the resources you want to monitor.
  3. Select Save at the bottom of the context pane.

Remove application permissions

  • Teams resources: On the Entra roles tab, assign the Teams Reader Microsoft Entra role.
  1. Select the checkbox next to the permission name, then select the Delete button in the command bar. Alternatively, hover over the permission and select the delete icon that appears.
  2. In the confirmation dialog, select Remove.

Manage Microsoft Entra roles

For the permissions required to snapshot or monitor Exchange resources, see Supported Microsoft Exchange resources for Tenant Configuration Management.

To manage Microsoft Entra roles assigned to the configuration management service:

  • Defender or Purview resources: On the Application permissions tab, assign Exchange.ManageAsApp. Then use Security & Compliance PowerShell to assign Security and Compliance (Defender and Purview) roles to the Tenant Configuration Management service principal. For the steps, see Connect to Security & Compliance PowerShell.
  • Select the Entra roles tab at the top of the page.

For the permissions required to snapshot or monitor Defender or Purview resources, see Supported Microsoft Security and Compliance resources for Tenant Configuration Management.

Add a Microsoft Entra role

  1. Select Add Entra role in the command bar.
  2. Select the Microsoft Entra role that the configuration management service needs.
  3. Select Save at the bottom of the context pane.

Remove a Microsoft Entra role

Remove permissions

  1. Select the checkbox next to the role name, then select the Delete button in the command bar. Alternatively, hover over the role and select the delete icon that appears.
  2. In the confirmation dialog, select Remove.

To remove a permission or a Microsoft Entra role, select the checkbox next to its name, and then select Remove in the command bar.

Related content