Nerdio Manager allows you to configure a solution baseline for Entra ID. You can choose to configure the solution baseline manually, or you can select a predefined template.
To configure a solution baseline for Entra ID at the MSP level:
-
At the MSP level, navigate to Solution Baselines.
-
Locate the Entra ID solution baseline section.
-
From the action menu, select Configure baseline.
-
In the General area, enter the following information:
-
Optionally, select the pencil
icon to change and edit the name of the solution baseline, or its description.
-
From the Solution Baseline Template drop-down list, select the template you want to use, and then select Apply template.
-
In the settings section, select the setting you want to enable and configure, and then select to Enforce, Report-only, or Exclude.
-
-
Once you have entered all the information, select Next.
-
In the Identity area, enter the following information:
Note
Be sure to scroll down to view and configure all the available options.
-
Once you have entered all the information, select Next.
-
In the Auth & Passwords area, enter the following information:
Note
Be sure to scroll down to view and configure all the available options.
-
Once you have entered all the information, select Next.
-
In the Summary area, review the changes.
-
Set the following options:
-
Process the Solution Baseline for Entra ID after saving: Select this option to apply the solution baseline to the assigned accounts.
-
Do you want to remove policies that are affected by this change?: If this option is selected, policies from this solution baseline are removed from the tenant if they don't have any other assignments.
-
-
Once you have reviewed the changes, select Save & close.
The Entra ID solution baseline includes the following settings, in addition to the ones in the steps above.
|
Wizard section |
Setting |
Notes |
|---|---|---|
|
General |
Security Defaults (Enabled or Disabled) |
Microsoft does not turn on security defaults in a tenant that has Conditional Access policies, so expect a Mismatch or a note. In Microsoft Entra, find the setting under Entra ID > Overview > Properties > Security Defaults. |
|
Identity > External Identities |
Guest self-service sign up |
New. |
|
Identity > External Identities |
External users can remove themselves |
New. |
|
Identity > Enterprise Apps |
Users can request admin consent |
The Reviewer Groups field was added. |
|
Auth & Passwords |
Registration Campaign |
Now includes Exclude Groups, Days allowed to snooze, and Limited number of snooze. The separate snooze actions were merged into this action and no longer appear in the list. |
|
Roles > Global Administrators |
Global Admins threshold |
New. |
|
Roles > Emergency Access |
Emergency Access threshold |
New. |
After an upgrade, background jobs update the built-in baselines and add the AuditLog.Read.All permission to the app registration. You can see them in System > Logs as Update built-in solution baselines and Update Account permissions from permission sets.
The baseline also contains a Temporary Access Pass policy in the Auth & Passwords step. For how it works, see Manage Temporary Access Passes.
Comments (0 comments)