A Microsoft 365 security baseline is the minimum set of configuration settings Microsoft recommends for your tenant, and it comes in more than one form. Baseline Security Mode is the tenant-wide set of settings in the Microsoft 365 admin center. The security baseline for Microsoft 365 Apps for enterprise is a separate, desktop-focused set of policies. Intune baselines cover Windows, Edge and Defender for Endpoint. This guide explains what each one does, the order we would apply them in, and how to avoid breaking a legal, energy or other regulated workflow while you do it.
TL;DR
- "Security baseline" in Microsoft 365 means three layers: tenant settings (Baseline Security Mode), Office app policies (the Apps for enterprise baseline), and device baselines in Intune.
- Start in the admin center: run the impact report for each Baseline Security Mode setting, turn on the ones with zero impact, and plan the rest.
- Legacy authentication and unprotected privileged accounts are the highest-value fixes. They are also the ones most likely to hit old scanners, line-of-business apps and shared mailboxes.
- A baseline is a floor, not a compliance program. SOC 2, HIPAA, CMMC and client security questionnaires ask for evidence, ownership and review on top of it.
Table of Contents
- The three layers people mean by "baseline"
- Baseline Security Mode: what it is and how to find it
- Security Defaults, Conditional Access and licensing
- The Microsoft 365 Apps for enterprise baseline
- Device baselines in Intune
- Measuring where you stand
- A baseline is not a compliance program
- Our perspective: baselines fail at the exceptions
- Where CISOSafe fits
- A 30-day plan for a mid-sized organization
- FAQ
- Sources
The three layers people mean by "baseline"
Search results for this topic mix several Microsoft products, and the confusion costs admins time. Separate them first.
| Layer | What it controls | Where you manage it |
|---|---|---|
| Baseline Security Mode | Tenant-wide settings across Microsoft 365 apps, SharePoint and OneDrive, Teams, Exchange Online and Microsoft Entra | Microsoft 365 admin center |
| Security baseline for Microsoft 365 Apps for enterprise | Application policies such as legacy file handling, DDE and macros | Group Policy or Intune, using the Security Compliance Toolkit |
| Intune security baselines | Windows, Microsoft Edge, Microsoft Defender for Endpoint and Windows 365 settings | Intune |
Microsoft describes Baseline Security Mode as a way to protect your environment against external threats, protect business data, prevent disruption, block unsafe practices, secure internal accounts and keep collaboration secure. It is the closest thing to a single "Microsoft 365 security baseline" switchboard, so most of this article starts there.
None of the three replaces the others. A tenant can pass every Baseline Security Mode check while laptops still run Office with permissive macro settings, and the reverse is just as common.
Baseline Security Mode: what it is and how to find it
Baseline Security Mode lets administrators set security settings across Microsoft 365 apps, SharePoint and OneDrive, Teams, Exchange Online and Microsoft Entra. You reach it in the Microsoft 365 admin center under Settings, then Org Settings, then the Security and Privacy tab.
The roles matter. Microsoft lists the Security administrator role, plus workload-specific administrators for Office Apps, SharePoint, Exchange or Teams, as appropriate for managing it. Decide in advance who owns each workload. A baseline change that touches Exchange and SharePoint should not be pushed by one person who understands only one of them.
Settings worth understanding before you click
The settings fall into a few groups: authentication, files and room devices. Two deserve attention in almost every regulated environment:
- Blocking legacy authentication. Legacy protocols cannot do modern multifactor authentication. Old copiers that scan to email, line-of-business apps and some mobile mail setups often depend on them.
- Phishing-resistant MFA for privileged roles. Global administrators and other privileged accounts are the accounts an attacker most wants. Hardware security keys or passkeys cost little compared with the damage of a compromised admin.
Microsoft also notes a prerequisite effect: turning on Baseline Security Mode settings makes certificate-based authentication for Exchange ActiveSync, a legacy Exchange flow, unavailable. If you have a mobile device program built on that method, find it before you change anything.
Run the impact report first
This is the habit that separates a clean rollout from a Monday-morning help desk flood. For each setting, Microsoft's guidance is to run impact reports, turn on settings with zero impacts, and address critical dependencies before making changes permanent. Its wider zero trust guidance also recommends impact simulation before enforcing Baseline Security Mode.
A workable sequence:
- Open the Baseline Security Mode page and review every setting's current status.
- Run the impact report for each setting and export the results.
- Turn on every setting that reports zero impact. This is free security with no user disruption.
- For settings with impact, list the affected users, apps and devices, and assign an owner to each dependency.
- Fix or retire the dependency (replace the scanner, update the app, move the mailbox to modern auth).
- Re-run the report, then enforce the setting.
- Record the date, the approver and the evidence. You will want it for the next audit.
Step 7 is the one most teams skip. For a law firm answering a client's outside-counsel security questionnaire, or an energy operator documenting access controls, the dated change record is often worth more than the setting itself.
Security Defaults, Conditional Access and licensing
Baseline Security Mode sits on top of identity decisions you may already have made. Microsoft's guidance is that new or small tenants should keep Security Defaults enabled, while tenants with Entra ID P1 or P2 should disable Security Defaults in favor of Microsoft-managed Conditional Access templates.
In practice:
- A ten-person firm on Business Basic or Standard with no Entra P1: leave Security Defaults on and work through Baseline Security Mode.
- A mid-market company on Business Premium or E3/E5 with Entra P1 or P2: move to Conditional Access, so you can write exceptions for named service accounts and locations instead of living with all-or-nothing rules.
Do not switch Security Defaults off until the replacement Conditional Access policies exist. A gap between the two is exactly when attackers probe.
The Microsoft 365 Apps for enterprise baseline
This baseline is about the Office applications on your endpoints. It provides application-specific settings, including restrictions for legacy files, DDE and unsigned macros, through the Security Compliance Toolkit. Microsoft frames it as a starting point that balances security benefits with user productivity, drawn from feedback from its security engineering teams and customers.
That framing is useful. These are recommendations to evaluate, not a mandate to apply blindly. A litigation support team that depends on a macro-enabled workbook will notice an unsigned macro restriction on day one.
What the recent release changed
The version 2512 release added policies for Excel, PowerPoint and core Microsoft 365 Apps components. Among them:
- External links to workbooks blocked by File Block no longer refresh, and attempts to create or update links to blocked files return an error.
- Non-HTTPS protocols are blocked when opening documents, which removes downgrade paths.
- Fallback to FrontPage Server Extensions RPC, an aging protocol, is disabled.
Microsoft publishes new versions periodically, so check the Security Compliance Toolkit for the current one rather than relying on a version number in a guide. If your intranet still opens documents over plain HTTP, or your finance team links workbooks across old file shares, test those paths in a pilot group first.
How to deploy it without a fire drill
- Download the current baseline from the Security Compliance Toolkit and read the accompanying documentation.
- Compare it with your existing Office policies. Most organizations already have a handful of overlapping settings.
- Deploy to a pilot group that includes your heaviest Excel and Word users, not just IT.
- Collect issues for one to two weeks, then document approved exceptions with an owner and a review date.
- Roll out in rings: departments, then everyone.
Device baselines in Intune
If you manage endpoints with Intune, Microsoft's guidance is to deploy security baselines for Windows, Edge, Defender for Endpoint and Windows 365 so compliance is reported directly in Intune. This closes the gap between a well-configured tenant and a laptop that still allows risky settings. Our workstation security playbook shows how to prioritize those endpoint controls when the list feels endless.
For teams that manage many tenants, Microsoft 365 Lighthouse baselines offer a repeatable, scalable way to manage settings across identity, email and apps, endpoints and data protection. That matters mostly to service providers, but a company with several subsidiaries or acquired entities faces the same problem.
Measuring where you stand
Two habits keep a baseline honest.
Score the gaps. Microsoft's Zero Trust Assessment gives an automated, scored gap list across identity, devices, data and network, which helps you prioritize high-value fixes at minimal cost. Pair it with the Baseline Security Mode status to see both views.
Go beyond configuration. A setting being on does not tell you whether an attacker can still get in through an unpatched system or an exposed service. Tools and procedures for reviewing and applying Microsoft-recommended configuration baselines are a good companion to the admin center, and a vulnerability scanning program tests what configuration reviews cannot. If you want a broader view of your identity layer, our Azure AD security assessment guide walks through it.
A baseline is not a compliance program
Regulated organizations get into trouble when they treat "we enabled Microsoft's recommended settings" as the finish line. Auditors and clients ask different questions:
- Who approved each exception, and when does it expire?
- Which framework control does each setting satisfy?
- Where is the written policy that the setting enforces?
- How do you know it is still on six months later?
A baseline answers none of these by itself. It supplies the technical control; you still need the policy, the owner and the evidence. A security gap analysis maps your settings to the frameworks you answer to, and our security templates give you audit-ready documents to record the decisions. If you are not sure how mature your program is overall, a cybersecurity maturity assessment sets the starting line.
Who feels this most
- Law firms: client outside-counsel guidelines increasingly ask about MFA, mailbox protection and access to matter data. Baseline settings produce concrete answers, if you can show the records.
- Oil and gas and energy operators: corporate Microsoft 365 often connects to field, vendor and contractor workflows. Legacy authentication and shared accounts are common, and removing them takes planning with operations.
- Healthcare-adjacent and other regulated mid-market firms: HIPAA and SOC 2 reviews look for access controls and change management around exactly these settings.
Our perspective: baselines fail at the exceptions
We review Microsoft 365 environments for regulated organizations, and the pattern is consistent. The settings themselves are rarely the hard part. The trouble starts with the exceptions that nobody owns: the scanner account that still uses legacy authentication, the former vendor with a permanent guest account, the privileged user without a hardware key because "they travel a lot."
Our advice is to treat the baseline as a living register. Every setting that is on gets a date. Every setting that is off gets an owner, a reason and a review date. Leadership sees a short summary: how many settings meet the standard, how many exceptions are open, and what the oldest one is. That is a view a managing partner or operations director can act on without reading admin center screens.
We also keep the order simple. Fix privileged identities first, then legacy authentication, then file and sharing controls, then endpoints. Test everything with the impact reports, and write down what you decided. A security-first operating model is built from small, documented decisions, not one big switch.
— vCISO
Where CISOSafe fits
Most firms we meet do not lack a baseline. They lack someone with the time and authority to apply it, document it and connect it to a framework. Our virtual CISO services, compliance program management and security risk assessments cover that gap: we assess your Microsoft 365 configuration, build the risk roadmap, write the policies that the settings enforce, and prepare you for audit and certification. The AI-powered platform automates intake and reporting, so leadership gets board-ready visibility without adding headcount.
If you want a second set of eyes on your tenant before the next client questionnaire or audit, contact CISOSafe.
A 30-day plan for a mid-sized organization
| Week | Focus | Output |
|---|---|---|
| 1 | Inventory admin roles, review Baseline Security Mode status, confirm Security Defaults or Conditional Access | Current-state list and role owners |
| 2 | Run impact reports, enable zero-impact settings, find legacy authentication users | Settings enabled, dependency list |
| 3 | Remediate dependencies, pilot the Apps for enterprise baseline | Pilot results, exception register |
| 4 | Enforce remaining settings, deploy device baselines, document everything | Dated change record and leadership summary |
The timeline stretches if you have many shared mailboxes or field-office devices. Keep going in the same order.
FAQ
What is Baseline Security Mode in Microsoft 365?
It is a feature in the Microsoft 365 admin center that lets administrators review and turn on Microsoft's recommended security settings across apps, SharePoint and OneDrive, Teams, Exchange Online and Entra. You can see impact before you enforce a setting. Nothing changes for users until an administrator applies it.
Is the Microsoft Baseline Security Analyzer still available?
The older analyzer is a legacy tool and not the route Microsoft points administrators to for Microsoft 365 today. Use Baseline Security Mode, the Zero Trust Assessment and Intune baselines instead, and confirm current tool status on Microsoft Learn.
How do I run the Microsoft security baseline?
For tenant settings, open Settings, Org Settings and the Security and Privacy tab in the admin center, then run each impact report. For Office apps, download the baseline from the Security Compliance Toolkit and deploy it through Group Policy or Intune, starting with a pilot group.
Is the Microsoft 365 Apps baseline the same as the tenant baseline?
No. The Apps for enterprise baseline sets policies inside Office applications on devices, such as macro and legacy file handling. Baseline Security Mode sets tenant-level controls across services. Most organizations need both.
Sources
- Baseline security mode settings | Microsoft Learn
- Implement baseline security measures | Microsoft Learn
- Security baseline for Microsoft 365 Apps for enterprise | Microsoft Learn
- Security Baseline for M365 Apps for enterprise v2512 | Microsoft Tech Community
- Overview of using Microsoft 365 Lighthouse baselines | Microsoft Learn