Skip to content
Andy Kemp Consulting

Run the assessment#

Open deploy.andykemp.com/baseline and sign in to your Andy Kemp Tools account. The release number (v1.4.5) is shown at the top of the page.

1. Connect your tenant#

Choose Connect Microsoft tenant and sign in with an account that holds Global Reader. The first time, you're asked to consent to AKC Baseline Deployer reading your directory, your policies and the sign-in methods report (see Consent).

Once you're signed in, the page links your tenant to your organisation and shows its name. The assessment starts straight away, and the page shows each area as it reads it.

Your Microsoft tokens stay in the browser tab. AKC never receives them, or anything the assessment finds.

2. Your result#

The page opens on your result:

  • The score: how much of the baseline is in place, as a percentage weighted by severity, in a dial. How it's worked out is on Findings.
  • A one-line verdict: where you stand, in plain language. If anything critical is missing, it says so first.
  • The six areas (licences, break-glass access, Conditional Access, authentication methods, how people sign in, admin accounts), each with a small bar of in place, partly and missing. Select an area to see just its findings.
  • Progress since your last run, from the second run on: the change in score, and which findings got better or worse. This is remembered in your browser only, for that tenant; nothing is stored anywhere else.

3. Fix these first#

The five most important gaps, in order: anything missing comes before anything partly in place, then by severity. Each has a one-line fix. Explain opens that finding in the full list.

4. The pictures#

  • Passkey readiness: how your members sign in today, in four bands from strongest to weakest: a passkey or security key, Authenticator, text codes or another app, and nothing at all. Passkey-only sign-in can only be turned on for the first band; the third would be locked out when text codes are turned off.
  • Conditional Access coverage: each baseline policy (CA000, CA001 and so on), whether your tenant has it on, in report-only or missing, and the policy of yours that covers it.
  • Admin accounts: every admin with the strongest way they can sign in. Admins need a device-bound passkey or a security key before CA901, phishing-resistant MFA for admins, is turned on for them. Windows Hello for Business and certificates don't count.

5. All findings#

Every finding, with filters:

  • Area: all areas, or one.
  • Show: everything, needs action (missing or partly), missing, partly in place, in place, or to review.
  • Search: a policy, an account or any word.

Each finding shows its status, catalogue reference, severity and area. Select it to open:

  • What we found: policy names, account names and counts;
  • Why it matters: the attack or failure it prevents;
  • What to do;
  • a link to its area on Findings.

6. Your roles#

Near the end, a card checks the roles you hold right now:

  • You hold a role that can read all this: you have Global Reader, Security Reader, Security Administrator or Global Administrator.
  • Global Reader is missing: advisory only. The assessment still runs, but some areas may show as couldn't read.
  • More than needed: if you hold a bigger role than the assessment needs (Global Administrator, for example), a notice names the smaller role and how to activate it just in time with PIM. It's a notice, never a blocker.

Under What deploying the baseline will need is a table of the roles each deploy step asks for. The assessment doesn't use them. Deploy the baseline checks the Conditional Access, group and Privileged Role Administrator roles, and Authentication Policy Administrator for the privileged accounts' passkey profile. Creating break-glass accounts, and the wider authentication methods, are still planned.

7. Save the report#

  • Save as PDF: an Andy Kemp Consulting branded report. It has a cover page with your tenant, the date, the score, the verdict and a table of the areas, then what to fix first and every finding with what was found, why it matters and what to do. It opens your browser's print dialog: choose Save as PDF as the printer. For the branding to show, keep Background graphics on, if your browser offers it.
  • Findings (CSV): one row per finding, with the area, reference, finding, status, severity, why it matters, what was found and what to do. It opens in Excel.
  • Full report (JSON): the whole result: the tool and release, when it was made, your tenant's ID and name, the score and counts, your role checks, any areas that couldn't be read, and every finding.

Files are named access-baseline-<tenant>-<date>. They're made in your browser and saved straight to your computer; nothing is uploaded. The report names accounts in your tenant, so keep it as you would any security report.

Check again reads the tenant again, for example after you've activated a role or fixed something.

When you're ready, Deploy the baseline, under What happens next, takes you to deploying the core Conditional Access policies, all report-only.

8. Afterwards: remove the app#

Access Baseline doesn't need to stay in your tenant. When you've finished, remove its access, and every permission goes with it:

  1. In the Entra admin center, go to Enterprise applications.
  2. Open AKC Baseline Deployer.
  3. Go to Properties and choose Delete.

If you run the assessment again later, consent is asked for again.