Complete Guide: Deploying Microsoft 365 Unified Tenant Configuration Management (UTCM)

Introduction

Monitoring configuration drift represents a major challenge for Microsoft 365 administrators. Unauthorized or accidental changes can compromise the security and compliance of your environment. Microsoft addresses this need with Unified Tenant Configuration Management (UTCM), a native solution that revolutionizes configuration management.

This article guides you step by step through implementing UTCM using PowerShell, from initial configuration to drift detection.

UTCM Architecture and Components

Before diving into configuration, let's understand UTCM architecture which is built on three fundamental pillars:

Snapshots

Snapshots capture the state of your resources at a given moment. They constitute your reference, your desired state. Think of it as a photograph of your conditional access policies or Exchange rules at a time when everything is perfectly configured.

Monitors

Monitors are the surveillance engine. They periodically compare the current state of your tenant with the reference snapshot. By default, this check runs every 6 hours.

Drifts

Drifts represent the gaps detected between the current state and the reference state. For example, if the name of a conditional access policy has been modified, UTCM will report it as a drift.

Technical Prerequisites

Before beginning implementation, ensure you have the following:

• PowerShell 7 or later installed on your workstation
• An account with the Global Administrator role in your tenant
• Microsoft Graph PowerShell modules installed

1Connect-MgGraph -Scopes 'ConfigurationMonitoring.ReadWrite.All'

UTCM Authentication Configuration

UTCM uses a dedicated service principal which allows it to access resources to be monitored. This approach ensures a clear separation of privileges and enhanced security.

1Install-Module Microsoft.Graph.Authentication

1Connect-MgGraph -Scopes 'Application.ReadWrite.All'

1# Creating the service principal
2$body = @{
3    appId = "03b07b79-c5bc-4b5e-9bfa-13acf4a99998"
4}
5Invoke-MgGraphRequest -Uri "v1.0/servicePrincipals" -Method POST -Body $body
6 
7# Assigning permissions
8$permissions = @('Policy.Read.All', 'Policy.ReadWrite.ConditionalAccess')
9$graph = Invoke-MgGraphRequest -Uri "v1.0/servicePrincipals?`$filter=appId eq '00000003-0000-0000-c000-000000000000'" -Method GET -OutputType PSObject | Select -Expand Value
10$utcm = Invoke-MgGraphRequest -Uri "v1.0/servicePrincipals?`$filter=appId eq '03b07b79-c5bc-4b5e-9bfa-13acf4a99998'" -Method GET -OutputType PSObject | Select -Expand Value
11 
12foreach ($requestedPermission in $permissions) {
13    $AppRole = $Graph.AppRoles | Where-Object { $_.Value -eq $requestedPermission }
14    $body = @{
15        appRoleId = $AppRole.Id
16        resourceId = $Graph.Id
17        principalId = $UTCM.Id
18    } | ConvertTo-Json 
19 
20    Invoke-MgGraphRequest -Uri "/v1.0/servicePrincipals/$($UTCM.Id)/appRoleAssignments" -Method POST -Body $body
21}

Creating a Reference Snapshot

The snapshot constitutes your baseline, your reference state. It is crucial to capture it when your resources are in the desired state.

Capturing Conditional Access Policies

To create a snapshot of your current conditional access policies:

1$uri = "beta/admin/configurationManagement/configurationSnapshots/createSnapshot"
2$body = @{
3    displayName = "Conditional Access Baseline"
4    description = "Criticial CA policies"
5    resources = @(
6        "microsoft.entra.conditionalaccesspolicy"
7    )
8}
9Invoke-MgGraphRequest -Uri $uri -Method POST -Body $body

Capturing Multiple Resource Types

To capture multiple resource types simultaneously, simply extend the resources array:

1resources = @(
2    "microsoft.entra.conditionalaccesspolicy",
3    "microsoft.entra.authenticationmethodpolicy"
4)

Setting Up Monitoring

Once the snapshot is created, configure monitoring to actively monitor drifts.

1# Filtering to locate the desired snapshot
2$filter = "displayName eq 'Conditional Access Baseline'"
3$uri = "beta/admin/configurationManagement/configurationSnapshotJobs/?`$filter=$filter"
4# Retrieving the snapshot
5$snapshot = Invoke-MgGraphRequest -Uri $uri -Method GET -OutputType PSObject | Select -Expand Value
6# Getting the configuration URI
7$resourceLocation = $snapshot[0].resourceLocation
8# Retrieving the complete configuration
9$resources = Invoke-MgGraphRequest -Uri $resourceLocation -Method GET
10$fineResources = $resources | Select displayName, description, resources

1$uri = "beta/admin/configurationManagement/configurationMonitors"
2$body = @{
3    displayName = "Conditional Access Monitor"
4    description = "Criticial CA policies Monitor"
5    baseline = @{
6        displayName = $fineResources.displayName
7        description = $fineResources.description
8        resources = ($fineResources.resources | Select-Object -Property displayName, resourceType, properties)
9    }
10} | ConvertTo-Json -Depth 10
11Invoke-MgGraphRequest -Uri $uri -Method POST -Body $body

Monitoring and Analyzing Results

Checking Job Status

Monitors run automatically every 6 hours. To view the results:

1# Finding the monitor ID
2$filter = "displayName eq 'Conditional Access Monitor'"
3$uri = "beta/admin/configurationManagement/configurationMonitors/?`$filter=$filter"
4$monitorJob = Invoke-MgGraphRequest -Uri $uri -Method GET -OutputType PSObject | Select -Expand Value
5 
6# Retrieving the results
7$filter = "monitorId eq '$($monitorJob[0].id)'"
8$uri = "/beta/admin/configurationManagement/configurationMonitoringResults?`$filter=$filter"
9$monitorResults = Invoke-MgGraphRequest -Uri $uri -Method GET -OutputType PSObject | Select -expand Value

Analyzing Detected Drifts

When drifts are reported, examine them in detail:

1$filter = "monitorId eq '$($monitorJob[0].id)'"
2$uri = "/beta/admin/configurationManagement/configurationDrifts/?`$filter=$filter"
3$configurationDrifts = Invoke-MgGraphRequest -Uri $uri -Method GET -OutputType PSObject | Select -expand Value

For a detailed view of changes:

1$configurationDrifts | ConvertTo-Json -Depth 10

Recommendations and Best Practices

Automation and Integration

While UTCM is powerful, it remains currently a set of APIs. For optimal use:

• Automate drift retrieval and analysis via Azure Automation runbooks
• Integrate alerts into your ticketing or notification system
• Document each snapshot with detailed descriptions to facilitate tracking

Permission Management

Monitoring Planning

• Create separate snapshots for different resource categories
• Establish a weekly routine for reviewing drifts
• Document legitimate changes to prevent recurring false positives

Conclusion

UTCM represents a significant advancement in proactive Microsoft 365 configuration management. By implementing this solution, you transform reactive monitoring into a preventive approach, ensuring the stability and compliance of your environment.

The key to success lies in methodical implementation, rigorous documentation, and intelligent automation. As UTCM evolves toward its final version, the foundations you lay today will allow you to fully leverage its future capabilities.