Your Baseline Is a Checklist. It Should Be Code: A Review of Simeon Cloud
TL;DR
- Desired state configuration combines a backup solution with a traditional imaging mindset: define how a tenant should look, snapshot it, and continuously compare reality against it.
- Microsoft 365 DSC is free and PowerShell-based, but its configuration whitepaper runs over 80 pages and our own setup of a single tenant took more than 8 hours.
- Drift, the quiet movement of tenant settings away from your baseline, is impossible to track manually once you manage more than a handful of tenants.
- Simeon Cloud syncs connected tenants daily against your baseline, reports anything out of compliance, and lets you reconcile differences back to the standard.
- Our view as of February 2023: desired state configuration tooling becomes commonplace within 3 to 5 years as compliance expectations tighten.
Most IT teams manage Microsoft 365 security baselines with a physical checklist. Onboard a customer, walk the list, configure the tenant, move on. Keeping up with configuration changes afterward is a manual process, which mostly means it does not happen. This review covers the automation alternative, desired state configuration, across one or many Microsoft tenants: how the concept works, what Microsoft's free tooling demands of you, and an honest look at Simeon Cloud (opens in new tab), a commercial tool that automates the backup, deployment, and monitoring of configuration baselines.
What is desired state configuration, really?
Think of it as a backup solution crossed with a traditional imaging solution. Imaging may be a triggering word for some, but stay with us. You define your desired state, meaning how you would image a tenant, or all the Microsoft tenants you manage, covering everything from security configurations like Conditional Access policies down to the individual applications you deploy. Then you take a snapshot of that image, like a backup, so you can continuously compare the existing state of any tenant against the desired state you defined.
What does Microsoft's free option cost you in hours?
Microsoft 365 DSC (opens in new tab) has been around for a while and uses PowerShell on the backend to do exactly what we just described. It is free, and it is a good place to learn the mechanics.
It is not, however, an easy ride. The whitepaper (opens in new tab) on configuring DSC runs over 80 pages. When we configured it ourselves, a single Microsoft tenant took more than 8 hours, and the process assumes proficiency with spinning up VMs in Azure, managing Azure DevOps, and deploying digital certificates. Budget accordingly.
Why do MSPs need this more than anyone?
If you are a Managed Service Provider, you are probably walking that onboarding checklist for every customer, with no automated way to detect drift, the changes inside a tenant that diverge from your baseline. Meanwhile the tool count keeps growing and compliance requirements keep tightening; many businesses now want a compliance framework to follow even when no strict regulation forces one.
Our opinion, stated as of February 2023: desired state configuration tooling will be commonplace within the next 3 to 5 years, because the security and compliance demands are outrunning what checklists can deliver.
How does Simeon Cloud hold up?
Microsoft DSC's setup pushed us to look for something with a real front end, and the search led to Simeon Cloud, a tool we had also used first-hand at an MSP we worked in previously. Four capabilities stood out in the Simeon portal.
Monitoring, backup, and reporting in one place
You connect Microsoft 365 tenants and compare their existing configuration against either Simeon's recommendations or a tenant you designate as the golden image for your baseline. The baselines are no joke: an extensive list spanning the Microsoft product line, including Azure AD, Exchange, Intune, SharePoint, and the Defender portal. Connecting a tenant produces an instant backup snapshot of its configuration and immediate reporting on how it compares to your baseline.
Daily drift detection and reconciliation
Initial configuration is half the compliance equation; detecting movement away from the baseline is the other half, and it gets harder with every tenant you add. With baselines defined in Simeon, tenants sync daily to detect drift, reports flag any tenant out of compliance, and you can immediately reconcile the differences to realign the tenant. Simeon also extends baselines to application package files, so you can deploy and repackage any Intune application across many tenants, a genuinely useful extra management layer.
Lifecycle management with approvals
Microsoft changes or introduces features constantly, and a mature operation tests changes in a demo environment before they reach production, with review before anything lands in the baseline. Using Azure DevOps on the backend, Simeon keeps a replica of your baselines across development and production environments and provides an approval workflow for promoting a change into production.
Multi-tenant standardization
A desired state tool has to support more than one tenant to matter for MSPs. Keeping up with baselines across every customer environment is a headache by hand and impossible at scale. Simeon standardizes baselines across all customers and alerts on drift daily, including the ability to push apps and configs from one tenant to another.
Our verdict
We recommend evaluating a desired state tool for the Microsoft tenants you manage today. Microsoft 365 DSC is free and the right place to learn what you are working with. If you want the process automated behind a friendlier front end, Simeon Cloud deserves a look: setting up a trial was easy in our experience, and one of their engineers walked us through the entire portal.
Frequently asked questions
What is desired state configuration for Microsoft 365?
A model where you define the intended configuration of a tenant, everything from Conditional Access policies to deployed applications, snapshot it like a backup, and continuously compare each tenant's live state against that definition.
Is Microsoft 365 DSC free?
Yes. Microsoft 365 DSC is free and a good way to learn the mechanics, but expect a steep setup: proficiency with Azure VMs, Azure DevOps, and digital certificates, plus a configuration guide that runs over 80 pages.
How does Simeon Cloud define a baseline?
You can compare connected tenants against Simeon's own recommendations, or designate one tenant as your golden image and use its configuration as the baseline for the rest.
Drift never announces itself
Whatever enforces your baseline, you still need proof of where tenants stand today. CloudCapsule scans 250+ controls per tenant in about 60 seconds and shows the deltas, so drift becomes a finding instead of a surprise.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
