Establish and Document the Application's Configurations - Application Management Best Practices
Establish and Document the Application's Configurations
(Chapter 104 of Application Management Best Practices)
Executive Summary: Chapter Overview
IF4ITThe Bottom Line
Core Concepts
| Concept | Definition & Strategic Role |
|---|---|
| Configuration Categories | The fifteen IF4IT baseline groupings of an Application’s settings, including Build, Packaging, Deployment, Instantiation and Runtime, Infrastructure, Security and Access, Observability, Resilience, and AI and Model. Addressing each category ensures no area of configuration is overlooked, and enterprises can customize the categories to their needs. |
| Configuration vs. Customization | For Vendor and SaaS Applications, configuration uses settings the vendor supports, while customization changes or extends the vendor’s product. Distinguishing the two matters because customizations usually carry more upgrade risk and must be identified and tested when the product is upgraded. |
| Authoritative Configuration Source | The place where a category’s configuration actually lives, which the documentation may link to rather than copy. IF4IT prefers configuration that is stored as code, versioned, and deployed automatically, and the Build, Packaging, and Configuration section points readers to it. |
| Application (Functional and Business) Configuration | Business rules and parameters, reference and lookup data, workflow settings, localization, and tenant settings. For Vendor and SaaS Applications, this category is often the main configuration surface, making it central to documenting purchased software. |
Quick Q&A
Question: Where in the Application Documentation are an Application's configurations recorded, and how often are they updated?
Question: How are Security Secret values and license keys treated within the Security and Access and Licensing configuration categories?
Read More Below
This chapter explains how to establish and document an Application’s configurations using the fifteen baseline configuration categories.
The Baseline Configuration Categories
The following categories are a baseline that IF4IT recommends; enterprises can customize them to their own needs.
| Category | Typical Content |
|---|---|
| Build | Tool and compiler versions, Build scripts and pipelines, Build parameters, dependency manifests. |
| Packaging | Artifact types, base images, artifact versioning scheme, signing, artifact repository locations. |
| Deployment | Deployment pipelines and scripts, Deployment strategy (such as rolling or staged), sequencing, pre- and post-Deployment checks, rollback procedure, approvals. |
| Instantiation and Runtime | Startup parameters, environment variables, runtime versions, memory and processor allocations, process counts, scaling rules, feature flags. |
| Application (Functional and Business) | Business rules and parameters, reference and lookup data, workflow settings, localization, tenant settings. For Vendor and SaaS Applications, this is often the main configuration surface. |
| Infrastructure | Compute, storage, and network settings such as ports, firewall rules, load balancers, and name resolution, per environment, and infrastructure-as-code definitions. |
| Integration and Interface | Endpoints, connection settings, protocols, message formats and schemas, queues and topics, API versions, timeouts, retries, rate limits. |
| Data Store | Schemas and their versions and migrations, connection settings, retention and archival settings. |
| Security and Access | Authentication and authorization settings, role and permission mappings, certificates and their expiry dates, encryption settings, Security Secret locations (never values), network security rules. |
| Observability | Logging levels and destinations, metrics, alert thresholds and routing, health checks, dashboards. |
| Resilience | High availability and failover settings, Disaster Recovery replication, backup schedules, recovery objectives. |
| Scheduling and Batch | Job schedules, dependencies between jobs, calendars, run windows. |
| Licensing | License keys (handled as Security Secrets), entitlement limits, license server settings. |
| AI and Model | For Applications that embed AI: model and provider, model version, prompts and system instructions, retrieval sources, parameters, guardrails, evaluation thresholds. |
| Client and Endpoint | Desktop and mobile client versions and settings, supported browsers and devices, distribution settings. |
Establish the Application’s Configurations
For each category that applies, identify the Application’s configuration, where it is stored, and how it differs between Instances. For Vendor and SaaS Applications, distinguish configuration, which uses settings the vendor supports, from customization, which changes or extends the vendor’s product, since customizations usually carry more upgrade risk. Prefer configuration that is stored as code, versioned, and deployed automatically.
Document and Share the Configurations
Record each category’s configuration, or a link to its authoritative source, in the Build, Packaging, and Configuration section of the Application Documentation, with Instance differences recorded explicitly. Record categories that do not apply as not applicable. Update the configuration documentation with every Release that changes it. Three especially important or complex categories have their own chapters: Security and Access, Integration and Interface, and AI and Model.
Best Practice: Establish and Document the Application’s Configurations
It is a best practice to both establish and document the solution for how an Application is configured: address every configuration category, record each configuration or its authoritative source with Instance differences, distinguish configuration from customization for vendor products, and keep it current with every Release.
Benefits: Documented configuration lets teams reproduce, troubleshoot, and recover an Application reliably, because the settings that determine its behavior are known rather than discovered. It also makes upgrades of vendor products far safer, since the enterprise’s configurations and customizations can be identified and tested.
Connections to Related IF4IT Practices and Inventories
The IT Operating Environments Best Practices addresses documenting configuration differences between environments and the use of infrastructure-as-code.
How to cite this page
When referencing this page in academic work, internal standards, or external publications, include the page title, IF4IT as author and publisher (The International Foundation for Information Technology (IF4IT), LLC), the URL, and your access date.
Example (informal web citation):
The International Foundation for Information Technology (IF4IT), LLC. Establish and Document the Application's Configurations | Application Management Best Practices. https://if4it.org/best-practices/application-management-best-practices/establish-and-document-the-application-s-configurations/ (accessed 2026-10-30).
See About Us for content governance and site-wide citation guidance.
Copyright for The International Foundation for Information Technology (IF4IT), LLC: 2008 - Present
Legal Disclaimers