How to Build a Microsoft 365 Security Baseline

A Microsoft 365 security baseline is a defined, mandatory set of security configuration settings that every identity, device, workload and AI agent in your Microsoft 365 tenant must meet. To build one, select a reference framework, assess your current posture, deploy controls in phases and continuously monitor for configuration drift.

Most enterprises have already enabled important security features in Microsoft 365: multi-factor authentication for most users, a handful of Conditional Access policies and some level of email protection. Far fewer can answer three harder questions:

• Does our tenant meet a defined security standard?
• Are those settings still in place today?
• Could we prove it to an auditor tomorrow?

That gap is not a technology problem. It is the absence of a baseline.

What Is a Microsoft 365 Security Baseline?

A Microsoft 365 security baseline is the documented minimum security configuration that an organization requires across its Microsoft 365 tenant, with defined owners, approved exceptions and continuous verification.

It typically spans six domains:

• Identity
• Email
• Collaboration (SharePoint, OneDrive and Microsoft Teams)
• Devices
• Data protection
• AI services

What makes it a baseline rather than a project is that it is mandatory, versioned and monitored. Every new user, site, device and agent inherits it by default.

Security baseline vs. security best practices

Best practices describe what is generally recommended. A baseline describes what is required in your organization, at what level, for whom, and with which documented exceptions.

A best practice says "enable MFA." A baseline says "phishing-resistant MFA is mandatory for all privileged roles. Standard users must use MFA through Conditional Access. Exceptions require CISO approval and expire after 90 days."

The difference is accountability.

Security baseline vs. Microsoft Secure Score

Microsoft Secure Score measures how many Microsoft-recommended actions you have implemented, weighted by points. It is a useful KPI, but it is not a standard.

A tenant can raise its score by completing many low-impact actions while still leaving a critical gap open, such as legacy authentication for a service account.

Use Secure Score to track progress. Use the baseline to define what "secure enough" means for your business.

Why Microsoft 365 Security Best Practices Are Not Enough Without a Baseline

Three forces make an informal approach increasingly risky.

• Configuration drift. Administrators create exceptions to solve urgent problems, new workloads arrive with permissive defaults, and Microsoft continuously introduces new settings. Without a reference state, nobody notices when a hardened tenant gradually becomes a permissive one.
• Audit evidence. Regulators, cyber insurers and enterprise customers increasingly ask organizations to demonstrate control, not describe intent. A baseline with monitoring produces that evidence on demand.
• An expanding attack surface. Identity-based security threats remain the most common entry point into Microsoft 365. Copilot and AI agents now amplify the impact of every weak permission, because they can discover and act on information at machine speed. Before expanding AI, organizations should confirm whether their Microsoft 365 tenant is ready for Copilot from a permissions and governance perspective.

Which Framework Should Your Microsoft 365 Baseline Follow?

You do not need to invent a baseline from scratch. Five references dominate the Microsoft 365 market, and each serves a different purpose.

• Adopt Microsoft Baseline Security Mode as the non-negotiable floor.
• Adopt CIS Level 1 as your formal baseline.
• Use ScubaGear and the Zero Trust Assessment as independent validation.
• Report Secure Score to leadership as a trend metric.

Organizations in highly regulated sectors can then selectively adopt CIS Level 2 controls for high-risk user groups.

How to Build a Microsoft 365 Security Baseline in 8 Steps

Step 1: Assess your current tenant posture

Start by measuring where your Microsoft 365 tenant stands against your chosen framework before changing anything.

• Review the Microsoft Baseline Security Mode dashboard and its impact reports under Org settings > Security & privacy in the Microsoft 365 admin center.
• Run ScubaGear and the Zero Trust Assessment to obtain independent, read-only findings.
• Inventory licenses, because many controls depend on Entra ID P1/P2, Intune, Defender or Purview entitlements.
• Document hybrid dependencies, including on-premises Active Directory, Group Policy Objects and line-of-business apps using legacy protocols.

Watch out: assessment tools require privileged read permissions. Treat their app registrations as sensitive identities and remove them when the assessment ends.

Step 2: Define scope, risk tiers and exceptions

A baseline must specify who it applies to and at what level, not just which settings it contains.

• Define tiers for standard users, privileged administrators, guests, service accounts and AI agents.
• Assign Level 1 controls to every tier and Level 2 controls to high-risk tiers, such as finance, executives and administrators.
• Create an exception register with a business owner, a justification, compensating controls and an expiry date.
• Translate the baseline into written security policies that the CISO and business leadership formally approve.

Watch out: exceptions without expiry dates are the single most common way baselines erode.

Step 3: Harden identity with Microsoft Entra ID

Identity is the control plane of Microsoft 365, so this is where the baseline delivers the greatest risk reduction.

• Require multi-factor authentication for all users through Conditional Access, and phishing-resistant MFA (FIDO2 or passkeys) for administrators.
• Block legacy authentication protocols tenant-wide.
• Build Conditional Access policies that combine user risk, sign-in risk and device compliance.
• Enforce just-in-time privileged access with Privileged Identity Management.
• Maintain at least two monitored emergency access accounts excluded from Conditional Access.
• Evaluate Token Protection for Exchange Online, SharePoint and Teams sessions, now included in CIS v7.0.0.

Licensing note: Conditional Access requires Microsoft Entra ID P1, which is included in Microsoft 365 E3 and Business Premium. Risk-based policies and PIM require Entra ID P2, which is included in Microsoft 365 E5.

Watch out: Microsoft Entra ID, formerly Azure AD, still contains legacy settings in many older tenants. Review them rather than assuming defaults are secure.

Step 4: Secure email and collaboration

Email remains the primary delivery channel for phishing, and collaboration settings determine how far data can travel.

• Publish SPF, DKIM and DMARC records, then move DMARC progressively toward enforcement.
• Block automatic forwarding to external domains in Exchange Online.
• Apply Standard or Strict preset security policies in Microsoft Defender for Office 365, including Safe Links and Safe Attachments.
• Restrict external sharing in SharePoint and OneDrive, and set the default link type to specific people or internal users.
• Define external access and guest policies in Microsoft Teams.

Licensing note: Defender for Office 365 Plan 1 is included in Business Premium; Plan 2 is included in Microsoft 365 E5.

Watch out: moving DMARC to reject before identifying every legitimate third-party sender can silently block business email.

Step 5: Enforce device and app compliance with Intune

Devices must prove they are healthy before they access corporate data.

• Use Microsoft Intune as your MDM platform, and make device compliance a Conditional Access requirement.
• Deploy Intune security baselines, starting with the Security Baseline for Windows 10 and later, which also applies to Windows 11 devices.
• Add the Microsoft Defender for Endpoint baseline and confirm onboarding across Windows, macOS and mobile devices.
• Apply the Microsoft Edge baseline and the Microsoft 365 Apps for Enterprise baseline, including blocking macros from the internet in Word, Excel and PowerPoint.
• For domain-joined Windows Server systems and hybrid devices, apply the Group Policy baselines from the Microsoft Security Compliance Toolkit.

Watch out: conflicting device configurations between Group Policy, Intune profiles and security baselines are a frequent source of unpredictable behavior. Assign one authoritative source per setting.

Step 6: Protect data with Microsoft Purview

A baseline must protect the information itself, not only the paths to it.

• Publish sensitivity labels aligned with your classification scheme.
• Deploy data loss prevention policies, starting in simulation mode.
• Confirm that unified audit logging is enabled and that retention meets your regulatory needs.
• Identify and remediate overshared SharePoint sites using Purview data security posture capabilities.
• Apply retention policies for regulated content.

Licensing note: basic labeling and DLP are available in Microsoft 365 E3. Auto-labeling, extended audit retention and advanced data security capabilities generally require Microsoft 365 E5 or E5 Compliance add-ons.

Watch out: labeling without enforcement creates a false sense of security. Every label should map to a concrete protection or DLP behavior.

Step 7: Extend the baseline to Copilot and AI agents

AI agents are a new class of identity, and your baseline must govern them the same way it governs users.

• Remediate oversharing before expanding Microsoft 365 Copilot, since Copilot surfaces what users can already access.
• Scope at least one Purview DLP policy to Microsoft 365 Copilot and Copilot Chat interactions, as CIS v7.0.0 now recommends.
• Inventory agents through Microsoft Entra Agent ID, now generally available, and assign an accountable owner to each.
• Apply Conditional Access to agent identities, using Microsoft's templates for autonomous agents and agents acting on behalf of users.
• Define data policies for Copilot Studio connectors, knowledge sources and actions.

For a deeper analysis of AI-specific threats, see our guide to the oversharing, prompt injection and excessive agency risks in Microsoft 365 Copilot.

Licensing note: as of October 2026, Conditional Access for agents requires a Microsoft Agent 365 or Microsoft 365 E7 license in addition to Entra ID P1/P2.

Watch out: agent sprawl grows faster than any previous identity type. Inventory and ownership must come before enforcement.

Step 8: Deploy safely and monitor for drift

A baseline that is deployed once and never verified will drift within months.

• Run new Conditional Access policies in report-only mode and use pilot groups before tenant-wide enforcement.
• Use Baseline Security Mode impact reports to identify affected users and apps before applying changes.
• Capture a desired-state snapshot and monitor it with Microsoft's Unified Tenant Configuration Management (UTCM) APIs, introduced in preview in January 2026.
• Manage configuration as code with Microsoft365DSC for repeatable deployment and reporting.
• Schedule quarterly Zero Trust Assessment and ScubaGear runs, and alert on policy changes through audit logs in Microsoft Sentinel.

Watch out: UTCM currently detects drift but does not remediate it automatically. You still need a defined change and remediation process.

Microsoft 365 Security Baseline Checklist

Use this checklist as a starting point. Validate licensing and framework references against your own tenant before adoption.

How to Map Your Baseline to Compliance Requirements

A well-documented baseline produces evidence that supports multiple frameworks at once. It does not ensure compliance on its own, but it substantially reduces the effort of demonstrating technical controls.

For organizations operating Copilot alongside other AI platforms, the AI portion of the baseline should sit inside a broader unified AI governance framework that defines policies, risk tiers and oversight across providers.

Common Mistakes When Building a Microsoft 365 Baseline

• Treating Secure Score as the baseline. A score is a measurement, not a standard. Define the standard first, then use the score to track it.
• Deploying baseline defaults without reading them. Microsoft's templates are a strong starting point, but every setting should be reviewed against your business processes before enforcement.
• Running several frameworks in parallel. Three standards produce three backlogs and no clear owner. Pick one authoritative baseline and map the others to it.
• Ignoring the hybrid estate. A hardened cloud tenant can still be compromised through on-premises Active Directory. Cloud and on-premises baselines must be governed together.
• Approving exceptions without expiry dates. Every exception should have an owner, a compensating control and a review date.
• Leaving AI agents outside the baseline. Agents with broad permissions and no owner are the next generation of shadow IT.
• Monitoring once a year. Annual reviews cannot keep pace with weekly configuration changes. Drift monitoring must be continuous.

Turn Best Practices into an Operated Baseline

Microsoft 365 already provides the security features enterprises need. The difference between a tenant that is secure on paper and one that is secure in practice is a Microsoft 365 security baseline that is defined, enforced and continuously monitored.

Organizations that make this shift gain more than stronger security. They reduce audit effort, lower the cost of incident response, accelerate safe Copilot adoption and give leadership a clear, measurable view of risk.

ne Digital helps organizations achieve this across the full lifecycle:

• Assessing current tenant posture against Baseline Security Mode, CIS and SCuBA.
• Selecting and combining the right frameworks.
• Implementing the baseline across Microsoft Entra, Defender, Intune, Purview and Sentinel.
• Operating it over time with drift monitoring and managed service

Start with a Microsoft 365 Security Assessment or explore our Microsoft 365 Managed Services to keep your baseline enforced as your environment evolves.