Baseline Security Mode<\/a> is designed to help IT teams enforce protections without breaking productivity. It\u2019s a shift toward proactive defense with standardized secure settings.<\/p>\n\n\n\nUnderstanding the need for Microsoft Baseline Security Mode<\/h2>\n\n\n\n Security must evolve with the environment.<\/p>\n\n\n\n
At Microsoft Digital, we\u2019ve built a strong foundation of endpoint protection over the years. But as our ecosystem expanded\u2014more devices, more workloads, more diverse user needs\u2014we saw an opportunity to take our security posture to the next level.<\/p>\n\n\n\n
Our existing configurations were effective, but they reflected the natural complexity of a large enterprise. Different teams had different requirements. Some relied on legacy technologies that had served them well. Others needed flexibility to support specialized workflows. Over time, this led to variation in how security policies were applied.<\/p>\n\n\n\n
We wanted to unify that approach.<\/p>\n\n\n\n
Baseline Security Mode emerged as a way to streamline and strengthen our defenses. It was about building on what worked. We started by identifying areas where legacy protocols and configurations could be modernized. That included technologies like ActiveX controls and older authentication flows, which we carefully evaluated and phased out where appropriate.<\/p>\n\n\n\n
We also improved how we gather and use telemetry. Initially, we had limited visibility into how certain features were used. That made it harder to predict the impact of changes. So, we ran pilots, collected feedback, and refined our approach. Baseline Security Mode was a game changer here, providing built-in reports that gave us the visibility we needed to observe the impact of applying settings in our environment. For example, when we reviewed blocking legacy file formats, we discovered that some workflows depended on them. We responded quickly, offering alternatives and guiding users through the transition.<\/p>\n\n\n\n
Ease of use was a priority.<\/p>\n\n\n\n
We built intuitive controls into the Microsoft 365 admin center, allowing IT admins to manage policies with just a few clicks. No more manual scripts. No more guesswork. We also introduced exception handling to support specialized needs, ensuring that security didn\u2019t come at the cost of productivity.<\/p>\n\n\n\n
We worked closely with internal stakeholders, including compliance teams and work councils, to validate every step and build trust. We made sure the experience was smooth, the tools were reliable, and the changes were clearly communicated.<\/p>\n\n\n\n
This wasn\u2019t just a technical upgrade\u2014it was a cultural shift.<\/p>\n\n\n\n
Baseline Security Mode gave us a way to unify our security posture while honoring the diversity of our environment. It\u2019s a smarter, more scalable way to protect our endpoints, and it reflects everything we\u2019ve learned from years of experience.<\/p>\n\n\n\n
Putting consistent security configuration into practice<\/h2>\n\n\n\n Baseline Security Mode establishes a new standard, enabling organizations to be secure by default. <\/strong><\/p>\n\n\n\nIt is the result of a collaborative effort of multiple product teams at Microsoft, building on their security and incident-handling expertise. It\u2019s designed to simplify and strengthen endpoint protection across Windows and Microsoft 365. The feature lives in the Microsoft 365 admin center, where IT admins can enforce modern security policies with just a few clicks.<\/p>\n\n\n\n\n\n
\n\u201cWhen we blocked certain file formats, users were confused by the error messages and thought they were blocked from saving the file. So, we ran pilots, gathered feedback, and helped the product team build an improved error experience to save blocked formats to safe, newer formats.\u201d<\/p>\nHarshitha Digumarthi, senior product manager, Microsoft Digital<\/strong><\/cite><\/blockquote>\n\n\n\nThe product teams delivered 20 features across five workloads: Office, OneDrive and SharePoint, Teams, Substrate, and Identity. Each one targets a specific risk\u2014blocking legacy authentication, disabling insecure protocols, restricting ActiveX, and more.<\/p>\n\n\n\n
When we deployed Baseline Security Mode as Customer Zero at Microsoft Digital, our job was to validate these features and controls in real-world enterprise conditions.<\/p>\n\n\n\n
We pushed for exception handling.<\/p>\n\n\n\n
Some users still relied on legacy formats or protocols. Certain teams, for example, needed access to older Office features. So, we worked with the product team to ensure exceptions could be built into the UI.<\/p>\n\n\n\n
That flexibility was key. We knew from experience that without it, customers might hesitate to adopt the feature.<\/p>\n\n\n\n
\u201cWhen we blocked certain file formats, users were confused by the error messages and thought they were blocked from saving the file,\u201d says Harshitha Digumarthi, a senior product manager at Microsoft Digital. \u201cSo, we ran pilots, gathered feedback, and helped the product team build an improved error experience to save blocked formats to safe, newer formats.\u201d<\/p>\n\n\n\n
We also pushed for better telemetry.<\/p>\n\n\n\n <\/figure>\n\n\n\n\n\u201cWhen we heard about Baseline Security Mode, it was still in ideation. There were no tools in the Microsoft 365 admin center yet. We had to figure out how to enable this internally while the product team built the capabilities in parallel.\u201d<\/p>\nMarkus Gonis, senior service engineer, Microsoft Digital<\/strong><\/cite><\/blockquote>\n\n\n\nAt first, we had only a few days of data. That wasn\u2019t enough to understand how features were used or what impact they would have. So we worked with the product team to expand telemetry, improve error reporting, and reduce false positives, including identifying bugs that skewed metrics and made troubleshooting harder.<\/p>\n\n\n\n
We ran the deployment through our Tenant Trust Program and work council reviews to ensure global compliance. That gave us\u2014and our customers\u2014confidence.<\/p>\n\n\n\n
Baseline Security Mode isn\u2019t just a feature. It\u2019s a shift in how we think about security, and we\u2019re proud to have helped shape it.<\/p>\n\n\n\n
Deploying Baseline Security Mode at Microsoft Digital<\/h2>\n\n\n\n Rolling out Baseline Security Mode wasn\u2019t just a technical exercise\u2014it was a cross-team effort that demanded precision, patience, and partnership.<\/p>\n\n\n\n
Microsoft Digital took the lead on deployment. We acted as Customer Zero, testing every feature in real-world conditions before it reached customers. That meant working closely with the product team to validate functionality, identify bugs, and shape the user experience.<\/p>\n\n\n\n
\u201cWhen we heard about Baseline Security Mode, it was still in ideation,\u201d Gonis says. \u201cThere were no tools in the Microsoft 365 admin center yet. We had to figure out how to enable this internally while the product team built the capabilities in parallel.\u201d<\/p>\n\n\n\n
Telemetry was limited. We had only 30 days of data to work with. That made it hard to predict how changes would affect users, so we ran pilots with internal user acceptance testing cohorts and we deployed in phases.<\/p>\n\n\n\n <\/figure>\n\n\n\n\n\u201cIt was a great Customer Zero experience. Our security teams stood to benefit from Baseline Security Mode features, and we helped the product team find bugs and the issues that just hadn\u2019t come up in early testing or at a large scale. It was a win-win situation\u201d<\/p>\nJohn Philpott, principal product manager at Microsoft Digital<\/cite><\/blockquote>\n\n\n\nFor some legacy protocols, usage was low. In these cases, the features being deployed made removing these protocols seamless. Where usage was higher or unclear, a more detailed approach was required.<\/p>\n\n\n\n
First, a few thousand users. Then 50,000. Then 100,000. Eventually, the entire Microsoft tenant. We paused between each wave to monitor help desk tickets, gather feedback, and confirm that our mitigation strategies were working.<\/p>\n\n\n\n
Communication was critical.<\/p>\n\n\n\n
We ran targeted campaigns, sent individual emails, and published technical reports explaining what was changing, why it mattered, and how users could adapt. We even used Viva Engage to notify users directly. It was important to explain to users why longstanding functionalities were being removed. We had to explain what we were doing and how to mitigate any impact.<\/p>\n\n\n\n
We did a lot of work with the product team to ensure the user experience and the IT pro experience both exceeded expectations.<\/p>\n\n\n\n
\u201cIt was a great Customer Zero experience,\u201d says John Philpott, principal product manager within Microsoft Digital. \u201cOur security teams stood to benefit from Baseline Security Mode features, and we helped the product team find bugs and the issues that just hadn\u2019t come up in early testing or at a large scale. It was a win-win situation.\u201d<\/p>\n\n\n\n
We flagged inconsistencies in policy syntax, pushed for better error handling, and worked with the product team to align deployment tools across workloads.<\/p>\n\n\n\n
But we didn\u2019t stop at deployment. We tracked progress, validated telemetry, and signed off on each feature before it moved into broader rollout. We even helped pave the way for the next iterations, identifying features that needed more design work or deeper telemetry before they could be deployed.<\/p>\n\n\n\n
This was a true partnership. The product team built the features. We tested them, validated them, and helped make them better.<\/p>\n\n\n\n
Baseline Security Mode is now live across Microsoft. And it\u2019s ready for the world.<\/p>\n\n\n\n
Capturing real benefits<\/h2>\n\n\n\n Baseline Security Mode is more than a set of policies\u2014it\u2019s a platform for proactive defense.<\/p>\n\n\n\n
The product team built it to reduce legacy risks and enforce modern security standards across Microsoft 365 workloads. Microsoft Digital validated it in production, surfacing bugs, shaping telemetry, and confirming that the features worked as intended.<\/p>\n\n\n\n
We tested 22 features across Office, OneDrive & SharePoint, Substrate, Identity, and Teams. Each one targeted a specific vulnerability\u2014like blocking ActiveX controls, disabling Exchange Web Services, or enforcing phishing-resistant authentication for admins.<\/p>\n\n\n\n
We flagged critical ActiveX dependencies in third-party apps \u2014something the product group hadn\u2019t found\u2014which enabled them to initiate removal. That kind of early detection helped fix issues before the features reached customers.<\/p>\n\n\n\n
We found regressions in PowerShell and legacy authentication flows. The OneDrive and SharePoint team caught a high-impact bug and worked with the product team to resolve it.<\/p>\n\n\n\n
That validation mattered.<\/p>\n\n\n\n
We also helped shape the admin experience.<\/p>\n\n\n\n
Exception handling was built into the UI. Admins could create security groups, assign users, and manage exclusions directly in the Microsoft 365 admin center.<\/p>\n\n\n\n
\u201cThere’s no need to handle everything manually,\u201d Philpott says. \u201cSimply click here and then here to disable. It’s a much simpler process.\u201d<\/p>\n\n\n\n
Extending benefits to Microsoft customers<\/h2>\n\n\n\n Baseline Security Mode is ready for enterprise.<\/p>\n\n\n\n
We\u2019ve tested it. We\u2019ve hardened it. And we\u2019ve made it easier to adopt.<\/p>\n\n\n\n
Microsoft Digital\u2019s deployment journey helped shape the product into something customers can trust. We didn\u2019t just validate features\u2014we made sure they worked in real-world environments, across diverse teams, and under the pressure of scale.<\/p>\n\n\n\n
The product team designed the features to be enterprise-ready. We ran them through our Tenant Trust Program and work council reviews to ensure compliance across global regions. That gave us confidence\u2014and gave customers confidence too.<\/p>\n\n\n\n
The benefits are clear. We\u2019ve reduced our attack surface. We\u2019ve improved compliance. We\u2019ve made it easier for IT teams to enforce security without disrupting workflows. And we\u2019ve laid the groundwork for secure-by-default computing across Microsoft.<\/p>\n\n\n\n
Customers can do the same.<\/p>\n\n\n\n
Start small. Run pilots. Monitor impact. Use the tools in the Microsoft 365 admin center to deploy policies, manage exceptions, and guide users through the change. And don\u2019t be afraid to ask for help\u2014our journey has shown that collaboration between deployment teams and product teams makes all the difference.<\/p>\n\n\n\n
Baseline Security Mode is ready, and we\u2019re ready to help others adopt it.<\/p>\n\n\n\n
Looking ahead<\/h2>\n\n\n\n The first wave of Baseline Security Mode\u2014BSM 2025\u2014delivered 22 features across five major workloads. Microsoft Digital helped validate and deploy those features across the enterprise. And the next wave of features is already in motion.<\/p>\n\n\n\n
And it\u2019s bigger, with 46 features, more than double what we had in the first round. The product team is expanding coverage to include deeper protocol restrictions, broader app controls, and more granular authentication policies.<\/p>\n\n\n\n
We\u2019re also preparing for broader industry adoption. <\/p>\n\n\n\n
Governments, regulators, and enterprise customers are asking for secure-by-default configurations. Baseline Security Mode is our answer. And the next version will make it even easier to adopt.<\/p>\n\n\n\n
We\u2019ll continue to lead as Customer Zero. We\u2019ll test new features, validate insights surfaced by telemetry, and share feedback with the product team. We\u2019ll run pilots, monitor impact, and guide users through the change. And we\u2019ll keep pushing for simplicity, scalability, and trust.<\/p>\n\n\n\n
Because security isn\u2019t a one-time project\u2014 It\u2019s a mindset, and it\u2019s Microsoft\u2019s highest priority.<\/p>\n\n\n\n