Welcome to the Azure Security Podcast, where
we discuss topics relating to security, privacy,
reliability, and compliance on the Microsoft
Cloud Platform. Hey everybody, welcome to episode
126. This week is myself, Michael, with Sarah.
And our guests this week are Sophie Kerr and
Dave Manassian to talk about Microsoft Baseline
Security Mode. But before we get to our guests,
let's take a little lap around the news. Sarah,
why don't you kick things off? Okay, so a couple
of things, a couple of exciting things. Well,
at the time of recording this, this was announced
last week, which is the new Frontier Suite. Now,
I know we don't talk about licensing that much
here on the podcast, but this is a biggie. So
we now have E7, and that means it's got an absolute
ton of different... things that you can buy together.
So you've got Agent 365 and Copilot and it's
called the Frontier Suite. So you can kind of
guess. We'll put a link in the show notes so
you can read up about it. But most people buy
some kind of Microsoft licensing and this is
one of the new big ones. So that's definitely
worth having a look at. And most importantly,
we also announced the GA of Agent 365, which
is coming in May. which is very exciting because
I love Agent 365. If you have been unfortunate
or fortunate enough to see me demo that at one
of the AI tour stops, it is very cool. And I
think it's going to have a lot of security uses.
Although it's not officially a security tool,
I cannot see it not becoming one. So if you're
waiting for when that's going to be announced,
the GA will be May 2026. And then last but not
least, again, at the time we're recording this,
it will depend, of course, Michael, however long
it takes you to edit this. But at the time of
recording this, next week is RSA in San Francisco.
Now, I'm going this year. I haven't been to RSA
since 2019. It's been a while. But again, I will
link to it in the show notes. Probably at this
point, you'll know whether you're going to RSA
or not. But RSA is obviously one of the very
big security conferences of the year. Microsoft
has a huge presence. We have a pre -day, we have
a post -day, and we have a karaoke party on the
Monday night. And of course, we have a booth,
et cetera, et cetera. Microsoft people who have
sessions. As I said, I will link to it all in
the show notes. So if you are going to RSA, definitely
go check out all the Microsoft events. There
are many. There are a lot of cool Microsoft security
people there. And I'm going to be there, though.
So, well, if you happen to be there, come say
hi. And that's it for my news this time. I have
a few items. First of all, I actually presented
just over a week ago now at the NDC Security
Conference in Oslo in Norway. I gave the keynote
there about 25 -ish years of the Microsoft security
development lifecycle. So kudos to Sarah. If
it wasn't for Sarah, I would not be doing NDC
because she made sure she hooked me up with all
the right people. Although it has taken a couple
of years for us to get together just with calendars
aligning. So yeah, it was really a lot of fun.
Got to meet a lot of really, really cool people.
And Oslo is definitely a bit cooler than Texas.
Next thing in public preview. There is EntraID
-based access for Azure blob storage over SFTP,
secure FTP. This is really cool because now you've
got, if you need to use SFTP, you've now got
all your single sign -on and multi -factor authentication,
conditional access, native RBAC and ABAC, and
access controller support, which is really good
to see. So again, you're moving away from sort
of a username and password. Next one, also in
public preview, is a customer -managed encryption
key support for... premium SSD version 2 disks
for Azure Database for PostgreSQL, my old stomping
ground in Azure Data. Again, anything that has
support for customer managed keys is always high
on my list because that way it gives the users
of the product absolute control of the keys.
Next up, we now have, in general availability,
a whole bunch of confidential virtual machines
based on the fifth generation Intel Xeon processors
using Intel Trust Domain Extensions, or TDX.
These are available now in various regions. It's
great to see, again, the continuation of more
support for more VM types that support confidential
computing. And with the news out the way, let's
get to our guests. As I mentioned, we have Sophie
and Dave here to talk about the Microsoft Baseline
Security Mode. So Sophie and Dave, welcome to
the podcast. We'd like to each take a moment
and introduce ourselves to our listeners. Thank
you, Michael, and thank you, Sarah. So hello,
everyone. My name is Sofika, and I'm a Senior
Product Marketing Manager here at Microsoft.
And I cover Agent 365, Security and Governance,
Microsoft 365, Security Copilot, Microsoft 365
Copilot, Security and Governance, as well as
Microsoft Baseline Security Mode. And hey, folks,
I'm Dave, and Michael and Sarah, thank you for
the invite. It's awesome to be here. I'm a principal
product manager on the product team across. So
I drive a lot of the admin experiences across
the board, specifically around content governance.
And as customers get ready for co -pilot and
AI adoption, the content management and governance
capabilities are becoming vital. So I drive a
lot of that. And also on the security front,
I drive many of the, again, prep and early thread
detection type of capabilities for our admins.
So yeah, that's me. Okay, you two. Well, thank
you for joining us. So I'm going to start with
the most obvious question, just so we level set
before we go on. But what is Baseline? What is
the Microsoft Baseline security mode? Yeah, that's
a great question. So Microsoft Baseline Security
Mode lives in the Microsoft 3C5 Admin Center.
What it does, it gives admins, IT admins, a single
place in the Admin Center to turn on a set of
security protection and baseline security protections
that we as Microsoft recommends based on real
world threat intelligence. Dave, anything you
want to add to that? No, I think one of the big
reasons why we decided to invest into baseline
security mode now is because we are seeing an
increase in amount of potential threats that
are kind of getting exploited, especially with
new kind of up and coming AI capabilities that
not only good guys have, but also bad guys also
get access to. Many of the things that specifically
settings and tenant kind of configurations that
were kind of had potential gaps within them or
especially, you know, kind of things that kind
of lingered around when. when they should have
been really deprecated. These type of things
are becoming more and more areas that bad actors
can exploit. And we decided to invest into this
now to really help customers and help really
kind of address the customer outcry around Microsoft,
you know, kind of recommended baseline or minimum
bar kind of configuration setup that we didn't
really... have before that span across Microsoft
365 and Microsoft in general. So we're investing
into that now to really kind of help our customers
hear from Microsoft what Microsoft thinks that
minbar should be. Dave and Sophie, you've already
kind of touched on this, but why did we need
this? Well, I think I know the answer to this
because I have seen there have been public talks
about, you know, some... default stuff that probably
needs changing. I've seen those over the years,
like various B -sides. But in your own words,
why do we need baseline security mode? We're
in the era of AI, AI apps, AI agents, and AI
can really accelerate the ability for malicious
actors to exploit configuration gaps. And specifically,
we're talking about legacy configurations that
can be the most vulnerable in your enterprise
environment. So we're talking about the amplification
of these legacy risk, how, you know, environments
now getting really, really complex. And so if
you're implementing a change, you may risk unintended
disruptions. And then also, if you use multiple
solutions, that could, you know, create a fragmented
security experience as well. And that is really
the problems that we're looking to solve. Dave,
do you want to add on to that on, you know, why
baseline security mode? No, I think you got it
all right. I think a lot of our customers depend
on, you know, kind of third party applications
or, you know, we had several customers that are
actually receiving legacy type of files that
Microsoft has discontinued for a while. And we
still support that, but we don't recommend the
usage of those. So we do have some customers
that are still kind of because of their customers
are using it. They kind of have to use it. But
those types of files, sometimes legacy files,
sometimes have different security risks. There
are different apps that are now coming in and
using. potentially could exploit these files,
et cetera. So we really are trying to do a few
things, and I think Sophie is going to cover
it in a minute. We're really trying to help the
customers, one, clearly understand what are those
recommendations that we have and what are the
potential areas of... vulnerabilities that exist.
And then the other thing is, is that we're trying
to help you identify these vulnerabilities. And
then the third, resolve them in a much easier
way, which we'll cover in just a minute. So why
now? It's because now we're seeing to Sophie's
point, you know, AI is coming into the picture
and it's really, you know, kind of expediting
then and potentially opening up these, you know,
existing potential problematic areas and potentially
increasing the risk for infiltration of bad actors
into the environment and tenant. Can you give
me like a really concrete example? So you mentioned
files and you mentioned the word legacy in there
as well. Is that like legacy settings? Is that
legacy configuration? You want to give a super
concrete example of something that's actually
in the product? I can give one example here.
For example, one of the settings that is available
in Microsoft Baseline Security Mode today is
that you can essentially block Microsoft Publisher
and block basic authentication. So that's one
example on the authentication side. And on the
file side, you can essentially disable people
from opening old legacy formats, and then they
can... block active X control. So those are some
of the examples. Anything else, Dave, you want
to talk about that really resonate with our customers?
Yeah, I think you covered it. Those are like
the really big ones that we see constantly happening.
The other one is we're allowing the admins to
actually control the app access, third -party
app access into the environment, especially when
it comes to third -party apps that have AI. A
lot of times what happens is up until now, the
users would just go test out a third -party app
like any of the AI providers. And as part of
that, if they have a connection to SharePoint
or connection to Microsoft 365, they would actually
activate that connector without realizing that
once that activation is made, data can start
flowing freely from the... security boundary
of Microsoft 365 out of that security boundary
into that new AI capability or AI tools that
they're testing out. And as a result, create
potential leaks of information. There's also
some of the security things that we have, like
labels, et cetera, that we have within. the confines
of the Microsoft 365 secure boundary that sometimes
does not get translated when the content flows
outside of Microsoft 365. So as a result, you
end up with leaked information into some third
party tools. So now we have capabilities within
baseline security mode. for the admin to actually
control the ability for their users to be able
to do this kind of things. So that's basically
that's another one. But I think the reason we
have every single setting is because like Sophie
mentioned earlier, we have had security kind
of MSRCs. kind of created within Microsoft 365.
And we actually had to go learn the hard way
to go deal with these security vulnerabilities
and close those gaps in Microsoft specifically.
So now we want to bring all that knowledge and
expertise out through this experience to all
customers across the board. So which products
is Microsoft Baseline Security Mode available
for? Yeah, great question. So right now in phase
one of Microsoft Baseline Security Mode, it is
now generally available for Microsoft 365 and
Microsoft Entra. Dave, do you want to speak a
little bit about potential roadmap for Baseline
Security Mode? Okay, so yeah, so definitely I
can definitely cover that. So as of right now,
we are supporting, you know, several apps. Also
Entra is one and then Microsoft 365, we're supporting
Teams. Exchange, SharePoint, certain apps in
SharePoint or capabilities in SharePoint. And
I think that's pretty much it. What's upcoming
is we're adding quite a bit more to this. So
there's going to be new settings that are going
to be coming in from PowerApps. There's going
to be more enhanced settings coming in from Exchange,
Teams, SharePoint, OneDrive. We're also bringing
in some Purview capabilities as well, settings
into BSM as well. And we are actually adding
a whole new surface area. So up until now, we've
been kind of covering apps as one -off type of...
settings within BSM. Now in V2, which is upcoming,
we're going to start seeing apps as a whole other
pillar. So there's going to be many different
things that are going to fall into that area
as well. So in other words, we're going from
around, I think it was around 18 settings or
so in V1 of BSM to around 30 or so, over 30 settings.
So we're still kind of, things are in fluctuation
mode right now. So we're still adding removing
settings for V2. So what are the key highlights
and features of the baseline security mode? Yeah,
so we think of it like this, like Dave has said,
and I've mentioned before. So BSM... allows you
to act on these tailored recommendations from
Microsoft so that you can secure your tenant
with these pre -configured default protections
against those known vulnerabilities in legacy
configuration. Then what's really interesting
is that you can adopt changes safely. So you
can actually test these configurations that you're
about to implement in simulation mode before
rollout. So that helps to make adoption more
straightforward and help you to minimize the
risk. So I think those are the two things that
I would definitely highlight for baseline security
mode. Dave, anything that you want to add to
that? Yeah, I think you did a pretty great job
covering it. I think the main thing that I want
to reemphasize is the ability for the admins
to really assess impact before the setting is
implemented. And on top of that, the ability
to actually stop the bleeding while certain kind
of change management processes take place. So
an example of this. would be, let's say, you
ran one of the settings or opened up one of the
settings, ran the impact analysis, and impact
analysis identified there's going to be certain
type of users or apps, depending on the setting,
that would be impacted if you took the recommendation.
In many of the settings, we are supporting exclusion
policies where you can add these... impacted
apps, users, et cetera, or sites to that exclusion
list, which means you're taking the recommendation,
you're stopping the bleeding for the entire tenant
while excluding the impact, and that buys you
time to actually go and work with the app owners
or file owners or users, right, and kind of off
-board them slowly and go through your... go
through your processes, change management processes
with the impacted folks to off -board them from
these kind of legacy experiences. So it not only
gives you a really easy way to kind of take the
action, but it also gives you the impact analysis,
exclusion policies to help you really roll things
out across the board in a very kind of easy way.
I know we don't talk about this too much on the
podcast, but it's obviously worth covering um
everyone probably if people are listening they
think wow this sounds amazing but how much does
it cost um uh you know is there an additional
cost for this or how how are we doing that yeah
so the great news is you can benefit from this
integration because Baseline security mode is
made by Microsoft for Microsoft with Microsoft
recommended configuration, and it is included
with your existing Microsoft 365 license. Yeah,
to add to that, we actually were, we did talk
about potentially putting it behind a license
of certain kind, but one of the things we realized
very quickly is that like the goal of this is
to really bring this experience and really help
all of our customers to close any kind of security
issues or vulnerabilities across the board. And
that didn't really feel like it would be fair
to put it behind a license. So we literally opened
it up to anyone and everyone across Microsoft
365. We love that. I love anything that's included.
That's always a good thing. As I said, I'm not
a big license person, but it is something to
think about. I know we already talked about some
concrete examples. Michael already asked you
that question. But so how does it work? So how
do you turn it on? And we know that often when
we change different settings and stuff, we can
break things, right? So how do you go about that
if someone wanted to turn on the baseline security
mode and not mess things up? Yeah. I can actually
cover that really quick. So it's fairly straightforward.
We made it as simple as possible. So you log
into your Microsoft 365 Admin Center. We build
it there so that, because that's usually the
place where all the admins kind of start the
experience of managing settings, etc. Now, once
you're there, you're going to click on Settings
in the left navigation, then go on to Org Settings.
And then once you're there, you're going to click
on security and privacy. And baseline security
mode is going to be right at the top. So when
you click on it, what you're going to see is
essentially us, like the wheel will spin. That
would be us actually looking at your settings
in your tenant and evaluating to see which settings
actually meet our... meet our recommendation
versus not. So once that evaluation is complete,
usually it takes about, you know, five seconds,
like two to five seconds, something like that,
pretty quick. Once that happens, in that same
panel, we'll show you the settings that we recommend
you to where we feel there's not much impact,
where you can actually just immediately implement
automatically. Or... there are going to be some
settings where we do see impact in general across
our customer base, and we do recommend you to
first run the impact analysis before implementing
that. We're calling this the one -click experience,
meaning you don't really have to do much. You
can just start the BSM evaluation and then you
click save. Once you click save, all the recommendations
will be automatically applied. However, you can
go more manual route and really pick and choose
the specific things that you want to initiate,
turn on, turn off, and decide on your own which
settings you want to run the impact analysis
for, etc. And to do that, on the bottom of that
left panel, you're going to see a button called
Open Baseline Security Mode. When you click on
that, we will show you a full dashboard of all
the baseline security mode settings. There's
going to be a column there called status. That
status column will show you which of the settings
that you have in your tenant meets the Microsoft
recommendation or meets Microsoft min bar, right?
And then you're going to see an indicator called,
you know, you know, called at risk. So at risk
means that specific setting is not really meeting
the Microsoft minimum security bar, security
mode, you know, kind of min bar. So the next
thing what you want to do is everything, obviously,
if it meets the standard, then you're all good.
Anything that is at risk, you want to actually
click on. And when you click on it, the left
panel will show up with. all the information
that you really need to know with all the learn
more links that if you really want to deep dive
into it, you can do that. But in most cases,
when you click on the setting, you will see an
area called or a button called generate report
that when you click on it, nothing actually gets
implemented. We just kind of run the impact analysis
without triggering anything. So what we recommend
you to do is you know, come to BSM security mode
page, look at everything that says at risk, go
into the panel, just get familiar with what it
says really quick, and then generate the report.
Again, generating report doesn't change anything.
It doesn't implement anything. It just literally
runs the report to tell you what the impact would
be if you were to enable the same. Okay, so that...
could take anywhere from a few minutes to a few
hours. And for some of the reports, depending
on how much data you have, it could take a few
days sometimes, right? So you want to kind of
initiate these reports as quickly as possible
to make sure that you have the data at your fingertips
when you actually are in a process of making
a decision. So once you do that, if anything
that basically... has no impact meaning there's
you know the impact analysis didn't find anything
generally it's you know kind of at that point
if nothing is impacted we recommend you to go
ahead and um you know kind of take the um or
you know make take the recommendation uh that
is given there uh and then click save policy
so once you save it uh obviously the we will
trigger all the apis to go in and uh close down
that gap in your in your ecosystem in your tenant.
Anything that says there is some potential impact,
in most cases, we have a scope area right under
the setting recommendation where you can literally
just exclude the impacted users or apps or whatever
the impact that is determined. is there again
and then once you exclude the impact you want
to take the recommendation and click that checkbox
so that you stop the bleeding so that new folks
are not using and creating more problems right
and then what we see customers do with the excluded
folks, right, excluded users or whatever from
the policy is they usually just contact the user
and try to work with them to kind of get them
off -boarded from using. these files. Now, the
funny thing is that we do have some customers
that actually, regardless of impact, they just
go in and implement all the recommendations.
And then they get, obviously, some users that
are impacted, and then they would let the admin
know that they're impacted, and then admin will
go and work with them. So sometimes that's a
lot faster way to implement it. There's a little
bit of user pain, but... you are closing security
gaps, known security gaps and vulnerabilities.
So we definitely recommend you to go do that,
you know, faster than like sooner, as soon as
possible, let's put it that way. So that's kind
of just a really quick overview of based on security
mode, but it's really not rocket science. We
build it to make it very, very easy. Okay, so...
This was announced in November at Ignite, but
what's the uptake been with customers so far?
Have a lot of people started turning on baseline
security mode? I know that you've got some stats
for us. Yeah, absolutely. Yeah, this has been
one of the probably fastest adoption I've seen
across several products that we've been. driving
so far. Just to give you an idea, in the last,
let's see, in the last 30 days or so, we've had
around 320 ,000 customers, unique tenants that
have started the workflow already. And we have
around 50 ,000 that have already finished. So
far. So it usually takes, depending on the size
of the organization, it takes, you know, anywhere
from and kind of how. eager is the customer to
really close the gaps very quickly. So we have
some organizations that just go ahead and just
do it right away. So as soon as they find out
about it within a few days, they're pretty much
done. And we have some organizations that are
a little bit more process oriented and they have
their processes that they have to go through.
And that sometimes could take a couple of weeks,
two, three weeks sometimes to get through it.
In majority of the cases that we see, it's a
pretty quick process. So far, it's a pretty fast
adoption, considering that we're dealing with,
one, security, kind of pretty, you know... impactful
security -related features. And then also this
is our admin capability. So admin capabilities
usually take longer to onboard and kind of get
going. But in this case, it's pretty fast. I'm
very proud of what we've been able to achieve
so far. With that, I want to, we always finish
off with asking our guests, what is a day in
the life of... Dave and Sophie look like? Because
Microsoft people have so many different things
they do. So I'm going to hit you, Dave, first.
Dave, what does a day in the life of Dave look
like, a typical day, if you have one? Especially
right now, it's pretty busy. So my meetings usually
start at around 6am. Usually I have meetings
across the different regions of the world. So
different depending on the project. Then I have
a bit of time to really catch up with emails
over coffee, probably about half an hour to 40
minutes. Then I jump in into spec reviews. I
drive a lot of different admin areas, including
SharePoint advanced management. So we have 15
to 20 feature crews that have specs and ideas,
et cetera, that have to review and kind of solidify
and approve, et cetera. Then there's design meetings
that we have to go through for feature development,
etc. And then lots of leadership updates and
LT buy -in meetings where we kind of take a lot
of these ideas, etc. And make sure that our executives
are aligned and kind of make sure that their
questions and their concerns are all addressed.
And my favorite time is... On Mondays, actually,
at around 8 p .m., we have all the different
feature crews that we have, which is around,
I think at this point, around 90 people or so,
come together and we share demos of different
things that we either coded or build, especially
with a lot of AI capabilities that are coming
on board. All of us are really becoming builders,
so regardless of discipline. So we're all building
and sharing things that we have created or researched,
etc. So it's always an exciting time to see how
much we can accomplish when all the tools are
in the ecosystem and they're working properly
and you really have access to all these tools.
So that's my typical Monday, I would say. Tuesday
is very different. Awesome. Sophie, how about
you? Yeah, I agree. No day, one day is the same.
But, you know, as a product marketing manager,
it's all about translating complex product and
security, you know, security features into these
stories. So a typical day for me is usually bouncing
between product deep dive. So for me to understand.
products such as baseline security mode, and
then having customer conversations such as executive
briefings or calls with customer and obviously
messaging work. So I try to on a daily basis,
right? So what I do is really connecting the
dots so that complex technology or simple ones
like BSM will show up in a very simple and credible
manner for those that need it. The last thing,
I know I warned you when we talked before we
recorded this, the last thing that we ask our
guests is, if you had a final thought to leave
our listeners with, what would it be? I'll go
first. So, you know, thinking about BSM, but
I really think security shouldn't. depend on
perfect decisions. So it really should start
with a safe default. So that's what I will leave
everyone with and then just get started with
baseline security mode today. Yeah, from my end,
this is something I'm reminded every day because
we're building a lot of AI, new capabilities,
agents, et cetera, within my orgs. And AI is
coming really, really fast. And it's something
that is really, and I know everyone has heard
about how it's developing really fast and our
environment is changing, but it really is changing
fundamentally how we look at security, how we
look at administration, functionality, the job
functions in general. And with these kind of
changes, it's really, really important to have
the tools in place and really implement the tools
that are provided, right? Especially from organizations
like Microsoft, right? And especially if they're
free, to implement them as quickly as possible
to really make sure that you meet the changing
environment and changing kind of threat ecosystem
vulnerabilities, et cetera. head on as quickly
as possible. So time is of the essence, especially
when it comes to these kind of known vulnerabilities
that BSM, that we're trying to bring to you guys
in a very, very simple way to really get them
applied as quickly as possible and close these
known areas to really reduce the surface area
of potential attack. Well, thanks, Sophie. And
thanks, Dave. With that, that's always our final
question and final thoughts. So we'll wrap it
up there. To everyone who's listening, thank
you very much for listening. We hope you found
this episode useful. And Michael usually wraps
this up, so I get to do it for once. We hope
you enjoyed this. Check out the show notes for
more details and stay safe and we'll see you
on the next one. Thanks for listening to the
Azure Security Podcast. You can find show notes
and other resources at our website, azsecuritypodcast
.net. If you have any questions, please find
us on Twitter at AzureSecPod. Background music
is from ccmixter .com and licensed under the
Creative Commons license.