365 Tenants: assign, roll out, enforce and roll back

Assigning

Under Roll out → Assign template you choose a released version and enter the tenant's values for the placeholders, for example:

• Emergency accounts: sign-in names or object IDs, one per line. Every blocking policy excludes them.
• IP ranges: in CIDR notation, one per line.

Deviations

The page then shows deviations from the template field by field: missing, different or not applicable. A stricter value in the tenant does not count as a deviation. Anything the tenant is not licensed for is neither written nor counted.

A run

1. Dry run. The plan shows every operation that would be written and the reason for every skipped one. Anything 365 Tenants could not read, such as Exchange without roles, shows as “not read” and is never written. Nothing is changed.
2. Request and approve execution. Approval is a separate step that requires the “roll out” permission.
3. Execute. The roll-out app applies the operations and then verifies every value. Conditional Access policies are then in report-only mode and do not block anyone yet.

Depending on scope, a run takes up to a few minutes. The page shows progress and refreshes itself; closing the window does not stop the run.

Two cases the plan names:

• If a Microsoft app that a policy needs is missing in the tenant, for example “Microsoft Intune Enrollment”, the run skips that policy. The reason explains how an administrator creates the app once.
• Some tenants require a one-time enablement of the organization in Exchange Online before external forwarding can be blocked. 365 Tenants then enables it itself and resends the setting. Microsoft does not allow this enablement to be reversed, but it changes nothing for users.

Enforcing

Enforcement makes the template's policies effective and turns off Security Defaults, both in the same run. Beforehand, Check enforcement verifies:

• Emergency accounts: at least one must be suitable, that is present, active, Global Administrator and not synced from an on-premises directory.
• Report-only evaluation: for each policy the sign-ins since rollout, interactive and non-interactive, with the number that would have been denied or would have needed confirmation, and the affected accounts and applications. Without readable sign-in logs there is no enforcement.
• Observation period: by default seven days since rollout. Shortening it requires explicit confirmation.

You confirm the evaluation with a tick. If it is older than one hour, a new one is required.

If enforcement fails, 365 Tenants turns Security Defaults back on and the tenant is as before the run. If that fails too, the overview reports “Tenant without enforced MFA” and retries every ten minutes.

Rolling back

The most recent run can be rolled back.

• Changed values are restored.
• Newly created Conditional Access policies are disabled.
• Other newly created objects, such as Intune policies or named locations, remain and are listed in the report. Remove an Intune policy in Intune itself if needed.
• Anything someone else has changed since the run remains and is listed.
• Nothing is ever deleted. A rollback that would leave the tenant without enforced MFA is blocked.