Microsoft recently added Baseline Security Mode to the Microsoft 365 admin center. It brings a group of security settings that once required separate portals or PowerShell commands into one place.

The list includes controls for phishing-resistant authentication on administrator accounts, legacy sign-ins, application consent, insecure file connections, SharePoint scripts, and Exchange Web Services.

That sounds like a convenient security checklist. It is, provided the person using it pays attention to the other half of Microsoft’s instructions: run an impact report before turning on each setting.

A control can be sensible and still interrupt a scanner, add-in, older application, or recovery process that the firm depends on.

Easier to find does not mean safe to enable blindly

Most of the settings in Baseline Security Mode address practices that should have disappeared years ago. Old authentication protocols cannot enforce modern multifactor authentication. Password credentials on applications are harder to protect than certificates or managed identities. Unrestricted application consent lets employees give outside software access to company data.

Blocking those paths improves security. The trouble is that an old workflow may still use one of them.

A copier could scan through an outdated email method. A line-of-business application may connect to Exchange Web Services. An older document workflow may open files through HTTP or FTP. A SharePoint site built years ago may still rely on custom scripts.

If the firm turns on every recommended setting at once, several things can fail on the same morning. The help desk then has to determine which change caused which problem while employees are trying to meet deadlines.

The setting was not wrong. The rollout was.

Microsoft recommends starting with the impact report

Microsoft’s own Baseline Security Mode documentation gives a simple sequence:

Run an impact report for each setting.
Turn on settings that show zero impact.
If critical dependencies appear, address them before making the change permanent.

That report turns a generic recommendation into an environment-specific decision. It can show which users, applications, sites, or files still depend on a behavior the setting would block.

The report is also useful when the answer is “not yet.” Instead of leaving a risky protocol enabled indefinitely, the firm can identify the dependency, assign an owner, and set a date to replace it.

Without that record, exceptions tend to become permanent because nobody remembers why they exist.

Some controls need preparation before enforcement

Phishing-resistant authentication for privileged administrators is a good example. Microsoft identifies administrative accounts as frequent targets and recommends stronger methods such as passkeys or security keys.

The firm should register and test those methods before enforcement. It should also confirm how an administrator regains access if a device is lost. Locking down the account without a tested recovery path can turn a security improvement into an avoidable outage.

Application consent needs a different kind of preparation. Baseline Security Mode can restrict employees to low-risk permissions from Microsoft 365 certified applications or applications created inside the firm’s own tenant.

That reduces the chance that someone clicks “Allow” and gives an unknown tool persistent access to email or files. It may also block a legitimate application that staff connected without IT’s knowledge. The answer should not be to restore unrestricted consent. Review the application, its publisher, requested permissions, data handling, and business owner, then approve or reject it deliberately.

We covered the broader risk in Your Staff Is Using AI Tools You Don’t Know About. A baseline can enforce part of the policy, but someone still has to decide which applications the firm trusts.

Legacy connections deserve a named retirement plan

Several baseline settings block old authentication or connection methods across Microsoft 365, SharePoint, OneDrive, and Office applications.

These settings often reveal systems that have been quietly working for years. They may have survived migrations because nobody wanted to touch them. The impact report gives the firm a chance to replace them on a controlled schedule instead of discovering them through a failed login.

For each dependency, record:

The user, device, or application that still needs it
The business process it supports
The vendor or employee responsible for replacing it
The supported alternative
The target date for removal
The temporary exception and who approved it

An exception without an owner or end date is not a plan. It is simply an insecure setting that remains enabled.

Use the baseline as an audit, not a one-time project

Baseline Security Mode is useful even if the firm cannot enable every control immediately. The reports create an inventory of old dependencies and risky behaviors that may otherwise remain invisible.

Start with settings that show no effect. For the rest, work through the dependencies in order of risk and operational importance. Test changes with a small group when possible, schedule them outside critical periods, and keep a rollback path.

Law firms should avoid changing authentication or document access immediately before a filing deadline. CPA firms should not discover an old tax application dependency during filing season. The security work still needs to happen, but the timing should reflect how the business operates.

The same principle applies to Microsoft 365 features the firm already owns. As we noted in Microsoft 365 Prices Go Up in July: Are You Using What You Already Pay For?, buying a security capability and configuring it are separate jobs. Baseline Security Mode makes the controls easier to reach. It does not analyze the firm’s workflows or resolve the dependencies.

Ask what the report found

If your IT provider plans to enable Baseline Security Mode, ask for more than confirmation that the recommended settings are on.

Which settings showed zero impact? Which users or applications appeared in the reports? What remains blocked by a dependency? Who owns the replacement work? Which exceptions are still active, and when will they be reviewed?

A useful baseline project leaves the firm with stronger settings and a shorter list of legacy dependencies. Turning on everything without reading the impact report can leave the firm with an outage and very little idea where to start.

If your Microsoft 365 security settings have grown one change at a time, Artech can help assess the baseline, trace dependencies, and stage the rollout around your firm’s work.