Microsoft 365 Baseline Security Mode: should your business switch it on?

What is Microsoft 365 Baseline Security Mode?

Baseline Security Mode is an area within the Microsoft 365 admin centre that brings together recommended controls for Microsoft 365 apps, SharePoint, OneDrive, Teams, Exchange Online and Microsoft Entra.

Microsoft says the settings can be configured on all Microsoft 365 subscriptions and plans. Administrators can reach them through Settings, Org Settings, Security and Privacy, then Baseline Security Mode.

The name can sound like one standard configuration, but the settings remain separate. An organisation can review, test and enable each control independently. That matters because a control that is safe for a modern cloud only business may affect an older application, device or hybrid system elsewhere.

Why Microsoft has brought these controls together

Many Microsoft 365 security weaknesses come from old authentication methods, unnecessary application permissions, outdated file technology or services that remain enabled long after their original purpose has disappeared.

The relevant controls have existed across Microsoft Entra, Exchange Online, SharePoint, Teams and Microsoft 365 apps, but finding and managing them has required knowledge of several portals and, in some cases, PowerShell. Baseline Security Mode gives administrators a clearer place to review them.

This does not replace good account management, software updates, backups, staff awareness or incident planning. It provides another structured way to reduce avoidable risk within the Microsoft 365 tenant.

Protect privileged administrator accounts

One of the most important options requires phishing resistant multifactor authentication for privileged administrators. These accounts can change security policies, access data, create users and control services, which makes them particularly valuable to an attacker.

Phishing resistant methods include suitable passkeys and physical security keys. Before enforcing the requirement, every affected administrator needs to register an accepted method. Microsoft warns that enabling the policy without preparing administrators can lock them out of the tenant.

A properly protected emergency access account should also be planned and monitored. It should not be used for everyday administration, but it can provide a controlled route back into the tenant if a policy or authentication failure blocks normal administrator access.

Block old authentication methods

Legacy authentication protocols do not support modern access controls in the same way as current Microsoft sign in methods. They can allow an attacker to avoid protections that users expect to apply to their account.

Baseline Security Mode includes controls for blocking legacy authentication flows, basic authentication prompts and older SharePoint and OneDrive authentication methods. Microsoft recommends checking sign in activity and impact information first so that old mail clients, scanners, applications or scripts can be identified.

If a business still depends on an older method, the answer should not be to leave it enabled indefinitely. Record the dependency, decide how the device or application will be updated and set a realistic date for removing the exception.

Control which applications can access company data

A user can sometimes grant an application permission to access parts of their Microsoft 365 account. A convincing consent screen can therefore be used to gain access even when the attacker never learns the user's password.

The Baseline Security Mode options can restrict consent to applications that are Microsoft 365 certified or created within the organisation, and only where the requested permissions are considered low risk. This reduces the chance of staff granting unnecessary access to an unknown application.

Changing the consent policy affects future requests. Existing application permissions should still be reviewed so that unused, unexpected or excessive access can be removed.

Reduce risks from old files and document features

Older Office file formats and features can behave very differently from a modern Word document or Excel workbook. Baseline Security Mode includes options to open older formats in Protected View, block ActiveX controls, block old OLE objects and prevent Excel from launching Dynamic Data Exchange servers.

These controls reduce opportunities for a malicious document to run code or interact with other systems. They can also expose genuine business processes that still rely on an old template, spreadsheet or line of business application.

Microsoft also includes an option to block Publisher, which is no longer included with Microsoft 365 from October 2026. Organisations that still hold important Publisher files should decide how those documents will be converted and maintained.

Review SharePoint, OneDrive and Exchange dependencies

SharePoint settings can prevent new custom scripts and stop users installing applications directly from the SharePoint store. These restrictions improve governance, but a tenant with older customised sites should be reviewed before changes are applied.

Another setting can disable organisation wide access to Exchange Web Services. EWS provides access to email, calendars and contacts and has been used by many integrations. Turning it off can reduce the available attack surface, but it can also affect Office add ins, Power Query connections, cross tenant calendar features and some hybrid or older business applications.

This is the clearest example of why an impact report is essential. A setting may be desirable while still requiring an application update, a replacement integration or a planned migration before it can be enabled safely.

Do not overlook Teams Rooms and shared devices

Resource accounts used by Teams Rooms and meeting devices should not behave like ordinary user accounts. Baseline Security Mode includes controls that can restrict access to Microsoft 365 files, require managed compliant devices and block resource account sign ins from unmanaged clients.

These settings are most relevant where an organisation operates Teams Rooms, meeting panels or shared collaboration equipment. Check device support and management status before enforcement so that a security improvement does not leave a meeting room unable to sign in.

A safe way to introduce the settings

Microsoft recommends running the impact report for each Baseline Security Mode setting. If the report shows no impact, the setting can normally move forward. If it identifies a critical dependency, investigate and address that dependency before making the change permanent.

The review should be treated as a small security project rather than an afternoon of clicking switches. Record the current configuration, agree who approves changes, test with representative users and devices, and keep a recovery route available.

• Confirm who holds privileged administrator roles.
• Prepare phishing resistant authentication and emergency access.
• Run the impact report for every proposed setting.
• Identify old applications, mail clients, scanners and integrations.
• Review existing application consent and SharePoint customisation.
• Test important Office files, add ins and business processes.
• Introduce low impact controls first.
• Document exceptions with an owner and a removal date.
• Monitor sign ins, support requests and service health after each change.

Should your business switch it on?

Most organisations should review Baseline Security Mode and will benefit from enabling several of its controls. The correct final configuration depends on the licences, devices, applications, integrations and working practices in that particular Microsoft 365 tenant.

A small business with current devices and no complex integrations may be able to adopt many settings quickly. An organisation with hybrid Exchange, older finance software, custom SharePoint sites or specialist Office files may need a phased plan.

The goal is not to achieve a green dashboard at any cost. It is to remove unsafe technology while keeping the business working and leaving a clear record of the decisions made.

How Bury I.T. Support can help

Bury I.T. Support can review your Microsoft 365 tenant, run and interpret the impact information, identify dependencies and plan the settings in a sensible order. We can also help prepare administrator authentication, review application consent, modernise older sign in methods and document any temporary exceptions.

If a setting reveals an old device, application or workflow, we can help decide whether it should be updated, replaced or isolated. The result should be stronger security without unexpected disruption for your users.