Orchestrator Documentation

Get your M365 automation up and running in under 30 minutes — app registration, CONFIG365 container setup, first tenant onboarding, and your first deployment.

How a single multi-tenant app registration manages all customer tenants via centralized credentials and per-tenant admin consent.

The four Gitea repository types — orchestrator, tenant-template, baseline, and tenant-{slug} — and how they relate to each other.

End-to-end guide for onboarding a new tenant: discovery, admin consent, repo setup, configuration review, testing, production deployment, and handoff.

How to create and populate the baseline config repository — exporting from a reference tenant, manual JSON creation, placeholders, and ongoing maintenance.

JSON examples for all supported resource types: Conditional Access, security groups, Intune compliance policies, authentication methods, and Exchange transport rules.

Segment baseline files into named groups and restrict deployment to member tenants only. Supports direct membership (per-tenant) and dynamic license-based rules that auto-include tenants holding specific M365 SKUs — evaluated live at deploy time.

Configure automated nightly tasks: group split rebalancing with member filters, Exchange default font configuration, GAL visibility control, and Intune device auto-rename.

How CONFIG365 backs up the full MDE device inventory to the tenant Git repo — required delegated API permissions (Machine.Read), backup file structure, device record shape, and app protection integration.

Manage minimum OS versions for Windows, macOS, iOS, and Android across compliance and app-protection baseline policies. Latest OS versions are fetched automatically per platform. Detect impacted devices per tenant from Defender backups and apply threshold updates across the baseline in one operation.