Introduction:
This article has been created for our managed customers as a supporting resource for our CSIA email campaign. It provides further information on Baseline Security Defaults, why they matter, and what customers need to do to ensure their Microsoft 365 accounts are appropriately protected.
What is Baseline Security Defaults?
In Microsoft 365 tenants, Baseline Security Defaults are Microsoft’s minimum predefined security policies that provide basic protection for an organisation’s users and accounts without requiring complex configuration.
One of the main policies is to ensure all users have multifactor authentication (MFA) set up. MFA confirms your identity in more than one way, usually by using an app on your smartphone.
What is MFA?
Passwords can get comprised so having a second identifying method ensures it is you trying to access your account and not an imposter.
When Baseline Security Defaults is enabled, all users will be forced to setup MFA.
If users within your organisation are not technically confident, we recommend arranging support to help them set up MFA manually before enabling Security Defaults. This allows the rollout to be managed in a controlled, staged manner and helps avoid disruption or confusion across the organisation.
Why might Baseline Security Defaults be disabled?
If your Microsoft 365 tenant was created before Microsoft enabled Baseline Security Defaults by default, the setting may still be disabled.
There may be times when they need to be switched off temporarily. This is most common during the initial setup of a new Microsoft 365 tenant, while users are adjusting to a new email system and may need help setting up MFA. Temporarily disabling the setting can help users regain access and continue working while MFA is rolled out in a managed way. MFA should then be configured and Baseline Security Defaults enabled as soon as possible.
Baseline Security Defaults may also stop older applications or services from working correctly, such as scan-to-email features on multifunction printers or copiers. In most cases, suitable workarounds are available, but the setting may need to remain disabled until the workaround has been applied.
You have notified me that Baseline Security Defaults are disabled. What action is required?
We recommend contacting all users to confirm that MFA has been set up on their accounts. This guide will help them check whether MFA is already configured : Microsoft Authenticator – Checking Status.
If MFA has not yet been set up, users should be asked to complete this as soon as possible. This guide provides instructions to help them do this : Microsoft Authenticator – Manual Setup.
Once confirmation has been received that all users have configured MFA, Baseline Security Defaults can be enabled to help protect user accounts. If any user has not completed the MFA setup, they will be required to do so the next time they sign in, which may occur at an inconvenient time. For this reason, we recommend that users complete the setup manually while support is available.
Can Baseline Security Defaults be disabled if it causes issues?
Yes, Baseline Security Defaults can be disabled again if required. However, we would always prefer to resolve any underlying issues rather than leave your organisation exposed to unnecessary risk. If users are experiencing difficulties, please let us know so we can provide appropriate support.
Can I choose not to have Baseline Security Defaults enabled?
Yes. Ultimately, it is your Microsoft 365 tenant and we manage it on your behalf. If you instruct us to keep Baseline Security Defaults disabled, we will follow your instruction. However, we must make it clear that doing so increases the risk to your organisation. Compromised accounts can lead to data breaches and, in some cases, may result in ICO fines or other regulatory consequences. Please also note that if Baseline Security Defaults are intentionally left disabled, support from us would be at an additional cost in the event of a related cyber incident.
E&OE. Copying of this document, or text & images associated with it, is strictly prohibited. Imagery taken from Microsoft software is solely used for advice and training, Microsoft , Microsoft Windows and Microsoft Office are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Pro Logic Computers (UK) Ltd or its agents accept no responsibility for the content of this document or results from actions taken by it. This document is provided as is, with no warranty or liability.