The Self-Hosted M365 Orchestrator

What is CONFIG365?

CONFIG365 is a Configuration-as-Code solution for Microsoft 365. It enables MSPs and IT teams to:

• Define M365 configurations as JSON files in Git repositories
• Deploy configurations via Gitea Actions workflows with approval gates
• Use the same baseline across unlimited tenants
• Get clear, actionable feedback on every deployment

Management Portal

The CONFIG365 Management Portal is a full-featured, server-rendered web application bundled directly into the CONFIG365 container. Deploy baselines, inspect drift, manage apps and groups, configure Conditional Access sync, and automate nightly maintenance — all from a single, polished web UI backed by a Next.js server that talks to Gitea's API and manages tenant credentials securely. No CLI, no JSON editing, no extra software to install.

Portal Views

License-Based Policy Assignment

Policy groups can automatically include tenants based on their Microsoft 365 license subscriptions — no manual list maintenance required. Define a license rule once in the baseline and every qualifying tenant receives the right policies on their next deploy, even as licenses change over time.

{
  "Enterprise": {
    "membership": {
      "dynamic": [{
        "type": "license",
        "skuPartNumbers": [
          "SPE_E3",
          "SPE_E5",
          "ENTERPRISEPREMIUM"
        ]
      }]
    },
    "content": {
      "folders": [
        "conditional-access/enterprise"
      ]
    }
  }
}

System Architecture

Click to enlarge

GitOps Approach

CONFIG365 follows a GitOps model where configurations are stored as JSON files in Git repositories and deployed through CI/CD pipelines. This gives you:

Security Model

CONFIG365 runs as a single OCI container — on Azure Container Apps, Azure App Service, or any Docker host. The management portal, Gitea, act_runner, and token-api all run inside the same container. No third-party SaaS ever touches your tenant credentials or M365 configurations.

Multi-Tenant Architecture

For MSPs managing multiple tenants, CONFIG365 supports a shared baseline with per-tenant repositories. Each tenant repo inherits shared configurations while maintaining tenant-specific overrides and assignments.

Deployment Workflow

Every deployment follows a safe, predictable three-stage workflow:

Scoped Deployments

By default a deploy run is fully scoped — all enabled categories are planned and applied. The deployOptions pipeline parameter lets you restrict a run to a specific combination of operations and policy categories, so you can, for example, delete-only without touching any create or update logic.

# Gitea Actions workflow dispatch (manual override)
deployOptions: allowDelete,deployIntune,deployConditionalAccess

# ↳ Configure-Intune.ps1            SKIPPED  (no allowCreate / allowUpdate)
# ↳ Configure-ConditionalAccess.ps1 SKIPPED  (no allowCreate / allowUpdate)
# ↳ Remove-Intune.ps1               RUNS     (allowDelete + deployIntune)
# ↳ Remove-ConditionalAccess.ps1    RUNS     (allowDelete + deployConditionalAccess)

Deployment Feedback

CONFIG365 provides detailed, actionable feedback for every policy:

Handling Errors

CONFIG365 catches common issues before they become problems:

Backup Pipeline

A dedicated backup pipeline runs automatically each night at 2 AM UTC, exporting every client's live M365 configuration to their Git repository as plain JSON. The same resource types that can be deployed can also be backed up — making point-in-time restore as simple as copying files from a past commit back into the baseline and re-running the deploy pipeline.