The Microsoft Graph UTCM (Unified Tenant Configuration Management) APIs allow administrators to save Microsoft 365 tenant settings, create baselines, and compare configurations over time. This helps identify configuration changes and maintain governance across the tenant. See details at Use the Tenant Configuration Management APIs in Microsoft Graph.

To use UTCM, a Microsoft-managed service principal must be added to the tenant. Microsoft uses this application to access configuration data from your Microsoft 365 tenant.

Setup

See Set up authentication for Tenant Configuration Management APIs to learn how to authenticate to the Tenant Configuration Management (TCM) APIs and configure the TCM service principal for your organization.

Problem

The UTCM application is special because it is managed by Microsoft and cannot be removed from the tenant like most other enterprise applications.

Workaround

Instead, administrators can revoke its permissions to effectively disable it. Revoking the permissions prevents the UTCM application from accessing tenant configuration data.

Revoke step-by-step

If the UTCM application is installed in your tenant and is no longer required, you can revoke its permissions. Here’s how to do it step by step.

  • Open the Azure portal. Navigate to Microsoft Entra ID / Enterprise applications / All applications or open the page here.
  • Search for Unified (Unified Tenant Configuration Management). UTCM-App
  • If you cannot find the app, remove the filter Application Type == Enterprise Applications as here. UTCM-App
  • Click on the app Unified Tenant Configuration Management (App ID 03b07b79-c5bc-4b5e-9bfa-13acf4a99998). Open Security / Permissions.
  • In the Permissions list, click on the context menu (…) in each row, and click on Revoke permission. Confirm this action by clicking on Yes, revoke. Revoke UTCM-App
  • Repeat these steps for each permission entry.

Summary

Without the required permissions, UTCM cannot access tenant data and is effectively disabled until access is granted again (see Setup).

This approach allows administrators to effectively disable UTCM access, helping to meet internal security and compliance requirements. For more information, see the Microsoft Learn documentation on the Tenant Configuration Management APIs.