Microsoft365DSC is a PowerShell Desired State Configuration module that automates the deployment, configuration, extraction, reporting and monitoring of Microsoft 365 tenant settings, and it is built for Microsoft 365 administrators and DevOps teams who want tenant configuration managed as code rather than by hand in individual admin portals.

What it is

Microsoft365DSC is a PowerShell module for Microsoft 365 tenant administration. It models tenant settings as Desired State Configuration resources, so a configuration is authored, compiled, and then executed by an agent's Local Configuration Manager, running either on a machine or inside a container. That agent communicates back to Microsoft 365 through remote API calls, which means the executing host requires internet connectivity. The module covers a broad spread of the Microsoft 365 surface, reflected in its topics: Azure AD, Exchange Online, Intune, SharePoint, OneDrive, Teams, Power Platform, Security and Compliance, and Skype for Business. The master branch holds the latest release and is published to the PowerShell Gallery; the dev branch is where contributors propose pull requests, and it is merged into master periodically.

The concrete problem it solves is the manual, one-off configuration of Microsoft 365 tenant settings across the separate admin portals, and the drift that accumulates when those settings are changed by hand with no recorded baseline. Instead of applying settings portal by portal, an organization declares the intended state in a DSC configuration, compiles it, and lets the Local Configuration Manager converge the tenant toward that state. The same resource model also extracts and reports existing tenant configuration, so the module serves both as a deployment mechanism and as an inventory and monitoring tool for what a tenant currently contains.

Key capabilities

• Manages, configures, extracts and monitors Microsoft 365 tenant configurations through PowerShell Desired State Configuration.
• Installs from the PowerShell Gallery with Install-Module -Name Microsoft365DSC -Force, followed by Update-M365DSCModule to refresh the module.
• Runs from an agent's Local Configuration Manager on a machine or in a container, requiring internet connectivity for remote API calls to Microsoft 365.
• Ships resources across many workloads, including Exchange Online policies such as EXOAntiPhishPolicy, EXOSafeAttachmentPolicy, EXOSafeLinksPolicy, EXOAtpPolicyForO365, EXOAtpProtectionPolicyRule and EXOMalwareFilterPolicy.
• Maintains a master branch for the latest release and a dev branch for contributions merged periodically into master.
• Supports tenant licence verification through Microsoft Graph with Connect-MgGraph -Scopes "Organization.Read.All" and Get-MgSubscribed... before deploying resources.

Who uses it and how

• Microsoft 365 administrators who need to deploy, configure, report on and monitor tenant settings from a single declarative source instead of per-portal changes.
• DevOps teams that treat tenant configuration as code, compiling a DSC configuration and running it from an agent so tenant state is reproducible.
• Container-based deployments, where the compiled configuration runs from a Local Configuration Manager inside a container with outbound connectivity to Microsoft 365.
• Organizations on Microsoft 365 E5, Office 365 E5, or Microsoft 365 E3 with the Defender for Office 365 Plan 2 add-on, which is required for the Defender-related resources.
• Open-source contributors working through the dev branch, in a project with 2,393 stars and 677 forks.

Getting started

Run Install-Module -Name Microsoft365DSC -Force and then Update-M365DSCModule from a machine with internet connectivity. Getting-started guidance, additional documentation and further resources live at Microsoft365DSC.com, with an associated YouTube channel.

How it compares

The facts provided name no competing or paid products that this project replaces, and no similar tools appear alongside it here, so it stands alone in this registry. It occupies a distinct position as a Desired State Configuration based configuration-as-code tool for Microsoft 365 tenants, distributed under the MIT licence through the PowerShell Gallery.

When to use it — and when not to

Anyone self-hosting it must operate a DSC agent with a Local Configuration Manager, on a machine or in a container, with internet connectivity to reach the Microsoft 365 APIs. Defender for Office 365 resources require Microsoft 365 E5, Office 365 E5, or Microsoft 365 E3 with the Defender for Office 365 Plan 2 add-on; on an E3-only tenant the deployment fails, and it fails with parameter errors such as "A parameter cannot be found that matches parameter name 'EnableTargetedDomainsProtection'" or "PhishThresholdLevel" rather than a clear licensing message, so check tenant licensing before assuming a module or configuration bug. Teams without PowerShell and DSC skills, or tenants that cannot grant the required Graph and workload permissions, should not pick it.

Install-Module -Name Microsoft365DSC -Force
Update-M365DSCModule

A parameter cannot be found that matches parameter name 'EnableTargetedDomainsProtection'
A parameter cannot be found that matches parameter name 'PhishThresholdLevel'

Connect-MgGraph -Scopes "Organization.Read.All"
Get-MgSubscribedSku | Where-Object { $_.SkuPartNumber -like "*E5*" }

Connect-ExchangeOnline -AppId <AppId> -CertificateThumbprint <Thumbprint> -Organization <Organization>
Get-AntiPhishPolicy -Identity "Office365 AntiPhish Default" -Advanced

Set-M365DSCTelemetryOption -Enabled $False