Coming next (planned)#
v1.4.5 deploys the core Conditional Access policies, with the break-glass, privileged accounts, pilot and exclusion groups and the authentication strengths they use, all report-only, and the device-bound passkey profile for privileged accounts. Run again, it compares existing baseline policies with the baseline and updates the ones you choose. See Deploy the baseline. The rest of the deploy phase is still planned.
Not yet available
Everything below is planned. None of it is in Access Baseline v1.4.5. Details may change before release.
The rest of deploying the baseline#
As now, every value will be shown on a review screen before anything is sent. Turning a policy on and widening it to more people will be separate steps, each with its own review.
What's planned:
- Break-glass accounts: creating at least two cloud-only break-glass accounts on your
onmicrosoft.comdomain, with no licence and no mailbox, and putting them in the break-glass group. Today you choose or create the group, and add the accounts yourself. - The wider authentication methods, passkeys first: passkeys for everyone, Microsoft Authenticator, Temporary Access Pass, the registration campaign and system-preferred MFA, with text and voice codes turned off for the pilot group first, then for everyone. Today the tool only adds the passkey profile for privileged accounts.
- Turning policies on, one at a time, after seeing what each would have done in report-only.
- Widening policies beyond the pilot group, to a wider ring, then all users. The break-glass group and each policy's exclusion group stay left out at every stage.
- More of the catalogue: the policies the assessment checks that this release doesn't deploy yet.
Roles it will need#
The assessment page shows these under What deploying the baseline will need. The Conditional Access, group and Privileged Role Administrator roles, and Authentication Policy Administrator for the privileged accounts' passkey profile, are already used and checked by Deploy the baseline. These are for the planned steps:
| Step | Smallest role |
|---|---|
| Break-glass accounts (new) | User Administrator, plus Privileged Role Administrator |
| The wider authentication methods | Authentication Policy Administrator |
Global Administrator won't be needed. Activate each role just for the step that needs it, with Privileged Identity Management where you have it.
Later phases#
- Pilot and promote: see each policy's report-only results, then turn it on and widen it.
- Passkey stages with Auth-Onboard: people move to passkey-only sign-in in stages, and Auth-Onboard only moves someone to the passkey-only stage once they have a passkey.
- AKC Key Enrol: a small Windows companion app for registering a FIDO2 security key on someone's behalf, for break-glass accounts, admins and people without a suitable phone.
Until then, the assessment's findings say what to do, and you can make these changes yourself in the Entra admin center.