Overview

Optimize365 can automatically fix security misconfigurations in your clients' Microsoft 365 environments. This article covers how to enable remediation for a client, how to run a remediation, and how to undo one.

How Remediation Works

Remediation needs more permissions than the standard read-only connection. Enabling it grants consent to a second app registration, Optimize365-Write, and assigns it the administrator roles it needs to change Exchange, Teams, and related configuration. Every remediation is logged and can be undone individually.

Enable Remediation for a Client

Toggle the REMEDIATION switch on the client row.

Step 1 of 2: Microsoft 365 admin consent

In the dialog that asks for admin consent to manage Exchange and Teams configurations, click Grant Admin Consent.

Sign in with a Global Administrator account when prompted (opens in a new window).

Microsoft shows a permissions review page for the Optimize365-Write app. Review the requested permissions and accept them.

Click Next to continue to Step 2.

Step 2 of 2: Exchange & Teams administrator permissions

Exchange Administrator, Teams Administrator, and related roles are required for remediation. They are granted with the Optimize Role Granter, a temporary helper app that assigns the required administrator roles to the Optimize365 application and then permanently removes itself from the tenant.

1. Click Open Permission Window and approve the permissions in the popup.
2. Click Assign Roles to complete the role assignment.

If the permission window is blocked or unavailable in your environment, click Having trouble? to use Microsoft Device Login or assign the required roles manually. See Manually Enabling Remediation Roles for Optimize365.

When both steps are complete, the REMEDIATION toggle shows as enabled on the client row.

Run a Remediation

1. Open any security control that is currently failing.
2. At the bottom of the control detail page, review what Optimize365 shows before you act:
   • The exact configuration change that will be applied (shown as a script or diff)
   • The estimated Remediation Effort in hours — how long the fix would have taken to perform manually, without Optimize365
   • The Remediation Impact Prediction — which users, devices, apps, services, and processes will be affected
3. Click Auto-Remediate to apply the fix. Optimize365 executes the change and marks the control as compliant.

Undo a Remediation

All remediations are logged in the Activity Log tab. Each entry shows the control that was remediated, the timestamp, and the account that performed the action, with an Undo button next to it.

Click Undo on the remediation you want to reverse. A confirmation dialog shows the control and warns that this will reverse the changes made.

Type undo remediation in the confirmation field.

Click Undo Remediation.

Optimize365 restores the previous configuration, and the control returns to its prior state.

Each undo is independent and fine-grained. It reverses only that specific remediation. It is not a rollback to a point in time — other remediations you ran before or after it stay in place.

Best Practices

• Read the Remediation Impact Prediction before every Auto-Remediate click, especially for controls that affect sign-in.
• Before remediating authentication or Conditional Access controls, confirm the tenant has working break glass accounts. See Break Glass Accounts and Lockout Risk.
• Expect some controls to take 24–48 hours to show PASS after remediation. See Microsoft API Propagation Times.

Troubleshooting

The permission window is blocked

Click Having trouble? to use Microsoft Device Login, or assign the remediation roles manually using Manually Enabling Remediation Roles for Optimize365.

A remediated control still isn't showing PASS

Some Entra and Admin Center controls can take 24–48 hours to update because of Microsoft API propagation. Wait for propagation before re-running the remediation.

Security Notes

• Remediation makes write changes to the client tenant. Admin consent must come from a Global Administrator.
• The Optimize Role Granter removes itself from the tenant after assigning roles; the Optimize365-Write app keeps the roles it was granted.
• Undo reverses one remediation only; it does not restore the tenant to an earlier point in time.

Related Articles

• Activity Log
• Manually Enabling Remediation Roles for Optimize365
• Required Permissions & Roles
• Break Glass Accounts and Lockout Risk
• Microsoft API Propagation Times