Before you start#
Access#
Access Baseline needs an Andy Kemp Tools account for your organisation, approved for Access Baseline. Approval is per organisation.
Open deploy.andykemp.com/baseline. If your organisation doesn't have access yet, the page explains what the tool checks, what you need and what happens to your data, then lets you request access. Once you've asked, it shows where the request is: requested, declined or paused. When it's approved, the same address opens the assessment.
To see it first, watch the demo.
Roles#
You don't need Global Administrator for anything in Access Baseline.
For the assessment#
The assessment only reads.
| Role | What it can read |
|---|---|
| Global Reader (recommended) | Everything the assessment reads. It's the smallest role that does. |
| Security Reader | Everything except the authentication methods policy, which shows as couldn't read. |
If you sign in as a Global Administrator, the assessment still works, and the page tells you which smaller role would have been enough.
The page checks your active roles. If you hold Global Reader through Privileged Identity Management (PIM), activate it before you connect.
Some areas also accept smaller roles. See Troubleshooting for the role each area needs.
For deploying the baseline#
Deploying the core policies creates things, so it needs write roles. Which ones depends on your design:
| Role | When it's needed | Why |
|---|---|---|
| Conditional Access Administrator (or Security Administrator) | Always | Creates the authentication strengths and the Conditional Access policies. |
| Groups Administrator (or User Administrator) | When the tool creates any group or adds privileged accounts | Creates the security groups. |
| Privileged Role Administrator | For a new break-glass group, a new privileged accounts group, the exclusion groups, or adding accounts to the privileged group | These groups are role-assignable, so only this role can create them or change who is in them. |
| Authentication Policy Administrator | When the passkey profile for privileged accounts is ticked (the default) | Adds the device-bound passkey profile to the passkey policy. |
With the defaults, you need all four.
The Review screen checks these before anything is sent. Activate them with PIM just for the deploy, and choose Check again.
Consent#
Access Baseline signs in with its own app, AKC Baseline Deployer. The first time it's used in your tenant, someone who can grant admin consent signs in and approves it. Cloud Application Administrator is enough; you don't need Global Administrator for this either.
It asks for three delegated, read-only Microsoft Graph permissions:
| Permission | What it's used for |
|---|---|
Directory.Read.All |
Users, groups, roles and licences |
Policy.Read.All |
Conditional Access, security defaults, authentication strengths and the authentication methods policy |
AuditLog.Read.All |
The sign-in methods report (who has registered what) |
Delegated means the page can only read what your own role allows. These three are all the assessment asks for: no write permissions, and nothing to do with Azure subscriptions.
Consent is one-off. After that, anyone with a suitable role can run the assessment.
Deploy permissions#
Deploying asks for more permissions, at the point you deploy and only the ones your design needs: Policy.Read.All, Policy.ReadWrite.ConditionalAccess and Application.Read.All, plus Group.ReadWrite.All when creating groups or adding privileged accounts, RoleManagement.ReadWrite.Directory for a new break-glass or privileged accounts group or adding privileged accounts, and Policy.ReadWrite.AuthenticationMethod for the passkey profile. They're delegated too, and need admin consent the first time. See Consent to the deploy permissions for what each is for.
Licences#
- Entra ID P1 is needed for Conditional Access. It's included in Microsoft 365 Business Premium, E3 and E5. Without it, the assessment still runs, and says so as a critical finding. Deploying the baseline won't go ahead without it.
- Entra ID P2 (in Microsoft 365 E5) adds risk-based policies and Privileged Identity Management. Without it, the two risk checks (CA204 and CA205) are left out, the P2 finding shows as not applicable, and the two risk policies aren't deployed.
Access Baseline itself doesn't need a Microsoft licence.
Passkey profiles#
The passkey profile for privileged accounts needs passkey profiles turned on in your tenant's passkey (FIDO2) policy. Turning them on can't be undone, so Access Baseline never does it for you. If they're off, the deploy still runs and skips only the passkey profile. See When passkey profiles aren't turned on.
Security key models#
Attestation in the passkey profile already limits admins to certified security keys and Microsoft Authenticator. You can also limit CA901 to the authenticator models you list, by AAGUID: it's off by default, and Microsoft Authenticator's are filled in. If you plan to turn it on and your admins use FIDO2 security keys, have the AAGUID of each model ready. See Limiting passkeys by AAGUID.