When I look back at the Microsoft 365 security baseline I published for 2025, I'm surprised how much has changed in a single year. In the tenants I support, auditors expect more, compliance pressure is very real, and things Microsoft used to call "recommended" are increasingly enforced, sometimes with little warning. The security baseline 2026 is no longer something to aim for. Given compliance requirements, current attack trends and Microsoft's own changing defaults, it's the practical minimum. Below is my updated baseline for 2026, based on what I actually see in projects and compared against last year's 2025 checklist.

Phishing-resistant MFA is no longer optional

In 2025 Microsoft made phishing-resistant MFA mandatory in practice. If your privileged roles still depend on old Authenticator app notifications, SMS or security questions, you've been locked out of the main admin portals (Entra, Microsoft 365, Azure) since October 2025 unless you use a strong MFA method. There's also growing pressure to move all users to modern authentication, and service accounts in particular. I still come across tenants running legacy "per-user" MFA or old SSPR/MFA policies, even though Microsoft is phasing those out. Moving to the new Authentication Methods Policy in Entra ID can't wait any longer. It's the only policy that lets you enable or disable passwordless methods, passkeys and FIDO2 keys at a granular level, and with the old policies deprecated, there's no other way forward.

Practical tip: Before you migrate legacy MFA, open the Authentication Methods reports in the Entra ID portal (Identity → Protection → Authentication Methods). They show remaining dependencies on old methods, and you can export the usage data for analysis.

I walk through the process step by step in my article on migrating to the authentication methods policy.

Device code flow gets blocked across the board

The device code flow (the "device code grant" in OAuth) is still a risk many people underestimate. Since the Storm-2372 and Midnight Blizzard campaigns, most organisations I work with have blocked it through Conditional Access. In the Entra admin center you create a new policy, filter for "Client App" → "Device Code," and block any authentication attempt that uses this legacy flow. Some older scripts and tools will stop working, but blocking it is now simply expected under the Zero Trust model (see the Zero Trust overview).

The diagram below shows how Conditional Access intercepts sign-ins and stops this flow:

flowchart TD
    Logins["User sign-ins"] --> CA["Conditional Access"]
    CA --> DeviceCode["Device code flow blocked"]
    CA --> ModernAuth["Modern auth allowed"]
    DeviceCode --> Blocked["Access denied"]
    ModernAuth --> Allowed["Access granted"]

Figure: Conditional Access blocks the device code flow and lets only modern MFA methods through.

Direct Send, DMARC and legacy SMTP are on the chopping block

Email spoofing and legacy SMTP relay got a lot of attention in 2025. Microsoft now blocks "Direct Send" by default for every new tenant, and DMARC enforcement for inbound and outbound mail is (finally) turning into a baseline requirement, above all for regulated organisations. If you still don't have a proper DMARC policy in DNS, you're the exception now, and your risk keeps going up.

For Exchange Online, a basic DMARC entry in DNS can look like this:

_dmarc.example.com.   3600   IN   TXT   "v=DMARC1; p=reject; rua=mailto:[email protected]"

To find out whether anything still relies on Direct Send, go through your Exchange connectors in the Exchange Admin Center → Mail Flow → Send connectors and audit mailbox forwarding as well. More details are in SPF, DKIM & DMARC in Exchange Online.

Windows 10 and unpatched hybrid servers have no place in production

Windows 10 support ended at the close of 2025, so there's no excuse left for running it productively unless it's covered by Extended Security Updates (ESU) or completely isolated. I still find holdouts anyway: niche kiosks, lab machines, the odd departmental server. My security baseline 2026 leaves no room here. Windows 10 stays out of production unless it has ESU and sits fully segregated. On the server side, Exchange and SharePoint have to be patched, full stop. The ToolShell vulnerabilities in 2025 and the hybrid Exchange CVEs made it obvious that one outdated server is enough to get compromised. If you run hybrid Exchange, keep it patched and use the dedicated hybrid app (Exchange hybrid vulnerability guide).

Workload identities and agents need strict governance without secrets

With Copilot, automation and multi-cloud workflows, service principals and automation agents became part of everyday life in 2025. Yet far too many tenants still have app registrations with client secrets that never expire. In my updated baseline, every production workload identity moves to Workload Identity Federation (for example Azure AD federation for GitHub Actions or Azure DevOps) or to managed identities. That cuts the risk of leaked secrets considerably and makes credential management simpler. Agent governance through Administrative Units or Azure Policy has also gone from optional to baseline. If you use Copilot Studio or other agent platforms, schedule your access and DLP reviews now rather than later (AI agent governance checklist).

Logging and retention now run through Sentinel in the Defender portal

The big improvement in 2025 was that security and audit logging finally came together, with Microsoft Sentinel now living inside the Defender portal. Every tenant should have central logs by now, covering Entra sign-ins, audit logs and workload activity, kept for at least 90 days (180+ if you can), plus detailed retention for anyone on E5 or with Advanced Auditing. In my experience, unified logs are what make incident response, access reviews and JIT admin work the way they're supposed to (Incident response readiness: Microsoft 365 logging).

You'll find your audit log retention settings in the Compliance portal → Solutions → Audit → Retention policies.

My view is that the baseline is never done

If you've made it this far, you can see that the security baseline 2026 is no longer optional. It's the minimum for any Microsoft 365 environment. Microsoft keeps speeding up enforcement of phishing-resistant MFA, DMARC and agent governance. If you do the work now, you'll spare yourself audit findings, cleanup projects and damage to your reputation later. In 2025, "best practice" became a hard requirement. I expect the baseline to keep growing in 2026, but everything that's mandatory today belongs on an admin's list of finished tasks, not on the roadmap.