►
Description
In this 20-minute developer-focused demo, Nik Charlebois overviews Microsoft 365DCS (Desire State Configuration) – a PowerShell Module that represents your entire Microsoft 365 tenant’s configuration as code and allows DevOps to monitor and control configuration discrepancies. Capabilities include automate, export, synchronize, access, monitor, and report. Learn what it is, how to use PowerShell script to find/create a policy, import/export a configuration, monitor config drift, ways to maintain a desired state, etc. Q&A throughout. This PnP Community demo is taken from the General Microsoft 365 Development Special Interest Group (SIG) - Bi-weekly sync call recorded on October 28, 2021.
Demo Presenter: Nik Charlebois (Microsoft) | @NikCharlebois
Supporting materials:
• Repo - Microsoft365DSC | https://github.com/Microsoft/Microsoft365DSC
• Repo – Microsoft365DSC Resources List | https://github.com/microsoft/Microsoft365DSC/wiki/Resources-List
• Tool - Microsoft365DSC - Configuration-as-Code for the Cloud | https://export.microsoft365dsc.com/
Learn more:
• Learn more about the Microsoft 365 Patterns and Practices community at: http://aka.ms/m365pnp
• Visit the Microsoft 365 Patterns and Practices community YouTube channel: https://aka.ms/m365pnp-videos
A
A
If
you
go
to
github.com
microsoft,
microsoft,
365,
dsc,
dsc
stands
for
desired
state
configuration,
which
is
something
that
is
part
of
powershell
since
powershell
version
4,
which
was
released
back
in
2015
and
essentially
what
it
allows
you
to
do
is
represent
your
entire
tenant's
configuration
as
code
to
be
able
to
enable
devops
scenarios
be
able
to
do
some
controls
or
automate
change
management
processes
as
well
right.
The
the
module
has
been
available
now
supports
powershell
5.1
and
above
so
you
can
use
power,
powershell
7.
A
A
The
tool
leverages
the
powershell
draft
sdk
under
the
cover,
as
well
as
other
modules,
such
as
the
we're
using
the
pnp,
a
powershell
for
everything.
That's
sharepoint
related
we're
using
the
exchange
online
management
shell
under
the
cover,
so
there's
a
couple
of
dependencies
that
we
are
leveraging
and
on
top
of
this,
the
the
module
is
available.
A
The
way
we're
distributing
it
is
through
the
powershell
gallery,
so
within
a
single
command,
you
can
run
install
module,
microsoft,
365,
dsc
and
that
will
go
and
that
will
download
all
the
components
of
the
module,
including
all
the
dependencies,
all
the
microsoft
graph
modules
that
you
need
all
the
other
workloads
powershell
modules
as
well.
Okay,
so
what
is
desired?
State
configuration,
as
I
mentioned,
it's
been
released
around
2014.
I
think
it's
more
around
2015,
but
essentially
what
it
allows
you
to
do
is
represent
your
configuration
as
a
definition
in
a
certain
way
right.
A
So,
for
example,
if
you
want
to
say
all
right,
I
want
to
create
a
new
teams
calling
policy
that
will
prevent
anonymous
users
from
starting
a
meeting.
Well,
that
will
translate
something
like
this
here,
where
you
actually
and
it
looks
very
familiar.
It
looks
almost
like
json
formats,
some
users
right,
but
this
is
the
dsc
format
that
desired
state
configuration
out
of
the
box
uses
and
essentially
what
we
do
is
we
have
a
teams,
meeting
policy
block
and
in
there
we
define
what
properties
and
how
we
want
to
have
them
configured.
A
So
when
you
run
this,
it
will
go
and
it
will
analyze
your
tenant
check
to
see
all
right.
Is
there
a
teams,
meeting
policy,
name
demo,
meeting
policy
that
already
exists?
If
there
is
none,
it
will
go
and
it
will
create
it.
If
there
is
one
it
will
go
and
check
to
make
sure
that
all
the
settings
are
configured
in
that
desired
state,
as
mentioned
by
the
configuration,
and
if
it
doesn't,
then
it
will
go
and
it
will
automatically
update
those
parameters.
You
can
also
control
components
that
should
not
be
in
your
tenant
right.
A
A
Permission
second
thing:
I'm
defining
is
a
custom
teams,
calling
policy
that
will
be
named
nick
calling
policy
with
all
those
settings
in,
and
so
what
I'll
do
is
I'll
start
the
process
I'm
just
going
to
go
and
launch
my
demo
one.
That's
going
to
take
a
few
minutes
to
run
in
the
meantime.
What
I
want
to
do
is
I
quickly
want
to
do
an
overview
of
the
environment
right,
I'm
a
big
believer
in
doing
demos
without
smoke
and
mirrors.
So
I've
got
nothing
up.
My
sleeves.
This
is
my
demo
environment
right
now
you
can
see.
A
A
If
you
want
to
get
more
information
as
to
what
resources
are
supported
by
microsoft,
365
dsc,
you
can
go
to
the
github
repo
under
the
wiki
section.
We
have
resources
list
an
example
and
in
there
we
have
a
full
list
of
all
the
components
that
we
support.
Okay,
so
there's
about
140
different
macro
components.
Last
time
I
checked,
we
support
sharepoint.
We
have
team
support.
We
have
security
compliance
in
tune,
onedrive,
planner
o365,
the
licensing
part
exchange
online
azure
id
now.
A
One
of
the
challenge
that
we
have
right:
it's
always:
how
do
we
keep
up
with
the
constant
changes
in
microsoft,
365.
and
two
weeks
ago?
Is
it
two
weeks
already,
but
anyway
we
had
the
global
academic,
microsoft
and
our
amazing
team
of
mvps
and
microsoft
engineers
work
on
a
dynamic
resource
generator.
A
What
that
allows
us
to
do
moving
forward
is
that
we
can
actually
leverage
the
microsoft
graph,
open
api
definition
and
automatically
wrap
those
endpoints
into
dsc
resources
right.
So,
instead
of
us
always
trying
to
play
catch
up
and
create
new
resources
as
new
features
become
available,
the
discussion
is
now
shift
to
if
it's
on
the
graph
we'll
have
dsc
support
for
it
right
to
a
certain
extent,
there's
a
caveat
there
right
like
we
don't
want
to
play
in
what
we
call
the
data
plane
right.
A
We
don't
want
to
go
and
have
dsc
maintain
like
sharepoint
lists.
For
example,
it's
mostly
focused
on
configuration,
but
you
get
the
point
and
then,
if
you
go
in
and
for
example,
go
to
azure
id
from
that
list,
you're
going
to
see
the
list
of
all
the
properties
that
we
have,
along
with
the
description
of
what
they're
for-
and
we
also
provide
information
about
all
right.
So
what
permissions
do
you
need
to
be
able
to
go
and
export
those
or
automate
the
deployment?
A
Some
examples?
So
all
the
documentation
is
on
there.
We
also
have
an
amazing
team
of
mvps
from
the
community
that
are
working
on
revamping
our
entire
documentation,
creating
github
pages,
so
that
should
be
released
within
the
next
few
weeks.
So
let's
have
a
look.
This
is
still
running,
but
if
I
go
and
refresh
this
here
should
be
done
anytime
now
any
questions
in
the
meantime.
A
While
this
is
running
I
see
one,
can
we
do
an
explorative
configuration
absolutely
absolutely,
and
this
is
one
of
the
pillars
that
I'm
going
to
be
talking
about
in
just
a
few
seconds.
So
this
idea
of
being
able
to
do
a
snapshot
of
your
current
configuration,
so
powershell
doesn't
seem
to
be
eager
to
run
today.
In
the
meantime,
any
other
question.
Sorry,
I
just
want
to
make
sure
we
actually
get.
This
here
is
dc
how
they
set
up
the
pre-configure.
A
There
is
part
of
it
that's
being
done
with
the
the
pre-configured
demos
right
most
of
it
is
done
through
powershell
script,
so
they're
not
directly
leveraging
paracel
desired
state
configuration
last
time.
I
checked
right,
but
that
might
have
changed
also,
let's
actually
move
on
to
the
next
thing.
While
this
is
still
running.
One
other
thing
that
we
allow
you
to
do
is
take
a
snapshot
of
your
configuration
right
as
we
just
mentioned,
and
how
you
can
do
it
is
the
moment
you
go
in
and
install
your
powershell
module.
A
The
microsoft
365
desired
state
configuration
you
have
access
to
a
command
called
export
entry,
65
desired
state
configuration,
and
with
that
we
provide
a
graphical
user
interface
that
our
colleague
sebastian
lavaya,
who
you've
just
heard
from
built,
which
allows
you
to
go
and
pick
and
choose
the
components
you
want
to
go
and
export
from
the
configuration,
so
that
will
actually
launch
the
export
tool,
which
is
listing
all
the
resources
that
we
have
from
here.
You
can
go
in.
A
You
can
say
right,
you
know
what
I
want
to
unselect
them
all
and
I
want
to
be
very
picky
about
the
ones
I
want
I'm
going
to
grab
the
azure
id
application.
I
want
to
go
and
grab
the
exchange
online
organization
settings
right.
So
you
pick
and
choose
you
essentially
build
your
shopping
cart
and
then,
when
you
click
on
generate
what
it's
going
to
tell,
you
is
going
to
give
you
the
equivalent
command
that
you
would
have
to
run
to
be
able
to
export
that
configuration.
A
So,
in
my
case,
you
see
that
every
component
I
selected
are
listed
here,
copy
that
to
the
clipboard
run
it
in
your
powershell
console
and
that
will
go
and
automatically
export
the
configuration
into
a
dsc
file.
So
you
don't
have
to
go
and
run
and
write
it
from
scratch.
You
can
go
and
start
with
an
existing
tenant,
take
a
snapshot
of
those
configs
and
then
tweak
it
or
also.
The
other
thing
that
we
support
is
the
ability
to
go
and
clone
configurations
right,
a
lot
of
customers.
I'm
talking
to
what
they're
saying
is:
look.
A
We
want
to
have
a
dev
tenant
right
that
is
as
close
as
possible
to
production,
so
what
they're
doing
is
they're,
taking
a
snapshot
of
configuration
from
prod
extracting
that
taking
that
file
and
applying
it
onto
a
dev
tenant
effectively
cloning,
the
configuration
across
two
tenants:
where
are
we
at
powershell
all
right?
So
powershell
is
done.
So
if
I
go
back
here
refresh
that
I
can
see
my
nic
demo,
app
has
been
created.
Let's
have
a
look
here.
A
A
Sorry
about
this,
so
I
should
now
see
my
policy
in
there
now,
because
we're
leveraging
desired
state
configuration
under
the
cover.
Not
only
do
we
allow
you
to
go
and
automate
the
deployment,
so
this
is
my
policy
by
the
way
right,
the
desired
state
does
two
takes.
It
allows
you
to
bring
an
environment
in
the
desired
state,
but
it
also
ensures
that
that
environment
stays
in
the
desired
state.
A
So
what
it
does
it
has
a
job
that
won't
call
it
continuous
monitoring
for
the
purpose
of
this,
but
it's
actually
leveraging
something
called
a
local
configuration
manager
and
that
will
do
frequent
checks.
So
we
will
go
and
analyze
your
tenant
to
make
sure
it
is
still
in
the
desired
state.
So
let's
create
a
drift
okay,
so
I
defined
that
this
is
the
the
settings.
I
want
I'm
going
to
save
this,
so
we
all
agree
that
I'm
now
creating
so
there's
a
discrepancy
between
the
current
configuration
and
the
desired
configuration.
A
A
So
let
me
just
go
and
quickly
run
this
perfect
so
again
going
to
take
a
few
minutes,
but
what
it's
doing
now
is
connecting
to
my
remote
tenant,
getting
information
about
what
the
current
state
is
and
comparing
it
with
what
the
desired
state
should
be.
Based
on
the
configuration
I
sent
and
it's
going
to
report
on
the
discrepancies
now
I
can
do
many
things
right
with
that
by
default,
the
dsc
engine
is
configured
so
that
it
will
do
what
we
call
apply
and
monitor.
A
So,
if
it
detects
the
configuration
drift
here,
the
only
thing
it
will
do
is
log
an
event
in
event.
Viewer
to
let
me
know
it
detected
the
drift,
but
you
can
also
configure
it
for
apply
and
autocorrect
so
applying
to
correct
the
name
says
it
what
it
will
do.
Is
it
will
go
and
if
it
detects
the
drift,
it
will
automatically
fix
the
drift
so
reapply
the
desired
configuration
effectively
now
the
beauty
about
m365
dsc
is
that
you
can
slice
and
dice
it
right.
A
You
can
say
you
know
what
sharepoint
like
the
sharepoint
teams
right,
which
is
one
of
the
things
we
support.
If
there's
a
drift.
Well,
I
report
it
right.
I
want
to
be
in
control.
I
want
to
be
aware,
there's
a
drift,
but
don't
go
crazy
and
try
to
go
and
fix
it.
However,
security
and
compliance
that
is
mission
critical.
So
if
you
detect
a
drift
in
there
automatically
fix
it
and
send
me
an
email
to,
let
me
know
that
you've
detected
and
fixed
the
drift
right.
A
A
Normally,
what
I
recommend
customers
is
to
go
and
do
it
twice
a
day,
so
every
12
hours
right,
like
6am
6pm
again
sorry
about
this-
is
going
to
take
a
few
minutes
to
complete.
Let's
quickly
go
back
to
the
slide
deck.
So
this
is
the
export
and
synchronized
right.
So,
as
I
mentioned,
the
idea
is
that
you
can
just
take
a
snapshot
out
of
one
tenant
and
then
reapply
it
over
the
other.
A
Let's
talk
about
the
assessment
piece
so
that
there
are
different
assessments
that
we
support
as
part
of
the
the
the
microsoft
365
dc
assessment
piece
steve.
I
see
your
question
about
sending
an
email
if
you're,
using
something
like
azure
devops
to
have
schedule,
release
pipeline
that
will
do
in
the
check.
If
it
detects
the
drift,
it
can
send
an
email
with
all
the
information
pertaining
to
drift.
A
A
Right,
you
want
to
figure
out
all
right,
so,
what's
different
between
the
two
tenants
do
an
export
of
both
and
then
through
the
the
assessment
engine
that
we
provide.
What
we
will
do
is
we
will
analyze
both
config
figure
out
what
the
drifts
are,
the
the
discrepancies
between
the
two
and
we'll
generate
we'll
call
a
delta
report.
A
Okay,
the
delta
report
will
look
something
like
something
like
this
here
right,
so
it
will
tell
you
right
so
in
the
source
you
have
this
setting
here
set
to
three
the
setting
is
set
to
99
and
the
destination.
Let
me
just
do
a
quick
live
demo
of
this.
The
command
that
we
have
by
the
way
is
super
easy.
It's
one
command
called
new
m365.
A
A
Three,
it's
actually
demo
four
and
then
what
it
will
do
is
it
will
do
two
things
so,
under
the
cover
we
have
a
tool
called
dsc
parser,
so
we'll
take
both
configurations
and
it
will
convert
them
into
powershell
objects
and
then
what
you
can
do
with
this
is
you
can
actually
run
the
compare
and
it
will
generate
the
html
report
out
of
this
email.
So
yesterday
yeah
you
can.
Actually
you
know
what,
if
you
want,
you
can
plug
it
to
a
web
hook
right.
A
So
if
you
detect
a
drift,
you
can
actually
just
have
a
notification
sent
to
a
certain
web
book
that
will
automatically,
I
don't
know,
open
a
support
ticket
in
your
system
or
whatever
right.
You
decide
how
you
want
to
treat
that
so
we'll
sorry,
I'm
bouncing
back
and
forth
between
things
right,
so
we'll
let
the
assessment
run
in
the
meantime.
This
is
the
the
test
result.
So
remember,
I
was
actually
running
a
test
and
it's
coming
back
and
it's
saying
you
have
a
discrepancy.
A
The
my
calling
policy
here
is
not
in
the
desired
state.
We
know
we
created
that
drift
right
out
of
the
box.
This
is
what
parcel
desired
state
configuration
would
tell
you
now
with
microsoft,
365
dsc.
We
provide
you
with
more
insights
as
to
what
went
wrong.
So
not
only
are
we
telling
you
that
the
macro
component
is
the
team's
calling
policy,
but
we're
also
telling
you
that
the
allowed
delegation
is
the
problem.
A
Its
current
value
is
set
to
false
and
it
should
have
been
set
to
true
right
and
here's
a
list
of
all
the
desired
values.
Okay,
so
you
can
pinpoint
exactly
where
the
issue
is
now
the
one
thing
we
don't,
let
you
figure
out
is
exactly
what
time
right.
So
this
is
the
time
at
which
the
drift
was
detected,
10
31,
but
because
I'm
running
it
every
15
minutes,
maybe
it
happened
at
10
20..
A
A
A
Okay,
so
the
the
report
is
still
being
generated.
The
drift
configuration
we've
talked
about
this
right,
this
idea
of
being
able
to
do
continuous
monitoring
and
then
the
last
piece
is
something
I
call.
I
keep
joking
that
it's
called
the
pudding
lipstick
on
the
pig
feature,
but
essentially
all
it
does
is
it
takes
your
configuration
and
it
will
convert
it
into
a
either
an
html
or
an
excel
report.
This
is
what
the
report
will
look
like
if
you
were
to
export
it
to
excel
excel,
makes
a
little
more
sense
than
html.
A
A
Where
are
we
at
sorry?
I
just
want
to
make
sure
that
the
last
demo
completes.
I
know
I'm
probably
running
out
of
time
so
right
now,
it's
doing
it
scanning
my
production
environment.
It
figured
out
that
I
have
383
components
that
were
defined.
It's
going
to
do
the
same
thing
with
the
test,
the
dev
one
and
then
figure
out
what
the
discrepancies
are
and
hopefully
generate
my
html
report.
So
let's
go
to
questions:
what
about
changing
desired
state
to
match
the
current
update
to
the
c
to
natural
ongoing
changes?
A
Jim?
Can
you
just
elaborate
a
bit
more
on
this?
If
you
don't
mind,
I'm
just
trying
to
make
sense
of
your
question.
So
this
is
the
report
here.
You
can
see
that
in
my
source,
there's
an
exchange,
malware,
filter
policy,
missing
that
exists
in
dev,
but
not
in
prague,
the
opposite
also,
and
then
what
values
are
different
between
the
two
yeah?
If
you
can
just
add
more
details
are
in
the
chat.
A
The
other
thing
as
well
that
I
want
you
to
understand
is
a
lot
of
customers.
What
they're
doing
is
they
just
want
to
be
in
control
right?
They
don't
want
to
go
and
automate
the
entire
change
process,
but
they
want
to
just
be
able
to
report
on
configuration
drift
and
the
interesting
scenario
for
those
those
customers
is
they're
using
the
tool
to
get
a
full
snapshot
of
everything.
So
essentially,
they're
asking
the
question
to
the
tenant.
A
Tell
me
how
you're
currently
configured
they
take
that
configuration
and
they
push
it
right
back
on
the
tenant
and
say
by
the
way
your
current
configuration
has
now
become
your
desired
configuration
and
from
now
on
any
drift,
you
need
to
report
back
right,
so
you're
not
making
any
changes
you're,
taking
a
snapshot
and
setting
that
as
the
active
config
and
anything
that
changes
in
what's
defined
there,
you
get
control
over
you
get
report,
you
get
an
email,
you
get
a
text
notification.
However,
you
want
to
do
it:
okay,
okay,
that's
it
so!
Okay!