Keep a baseline for each customer
Create versioned baseline templates through the authenticated API, review observed differences and safety conflicts, and preview report-only MFA canaries that need each customer's consent and separate provider approval.
Contoso Dental
Baseline v7
Morgan Lee
12 Oct 2026 09:10
- Setting
- Legacy authentication protocols
- Current
- Enabled
- Baseline
- Blocked
- Change
- Block protocols
- Setting
- Safe Attachments
- Current
- Off
- Baseline
- On
- Change
- Turn on Safe Attachments
- Setting
- Guest access review
- Current
- Not read
- Baseline
- Read
- Change
- Review guest access
Preview only. Nothing is sent to Microsoft.
Settings drift back after you fix them.
Technicians repeat fixes when settings drift back, and customer exceptions get lost.
What you get
API templates
Partner admins can create versioned baseline templates and explicitly review customer assignments through the authenticated API.
Observed differences
Review observed baseline differences and safety conflicts before making changes.
Approved report-only MFA canaries
Preview deployment rings and apply supported report-only administrator-MFA canaries after each customer's Microsoft consent, separate provider approval and configured callbacks.
How it works
- 1
Define the baseline
Partner admins create versioned baseline templates through the authenticated API.
- 2
Review the difference
Compare observed baseline differences and safety conflicts before changing anything.
- 3
Stage the rollout
Preview deployment rings and apply supported report-only administrator-MFA canaries after each customer's Microsoft consent, separate provider approval and configured callbacks.
What needs setup
Connect the customer, then complete the customer consent, separate provider approval, configured callbacks and the Microsoft setup for any native change used by the deployment.
Limits
Changes still require their safety checks and scoped approval.
Ordinary Conditional Access, security-defaults and Intune selections stay manual work.
TenantVigil only reads your Microsoft 365 tenant. It never changes a setting: you apply each fix yourself.
Related documentation
Connect a customer with administrator consent, then review the findings and service work in your console.