UPDATE: Security Baseline for M365 Apps for enterprise v2306

Happy Monday everyone!

Fantastic way to start the week with the release of the recommended security configuration baseline settings for Microsoft 365 Apps for enterprise, version 2306.

📌This baseline builds on the previous Office baseline we released June 2022. The highlights of this baseline include:

• Added a new setting to Microsoft Publisher around blocking macros from the internet

• Added a new setting around Basic Authentication

• Added a block for Excel XLL add-ins

• Added a new encryption format for Information Rights Management

The recommended settings in this security baseline correspond with the administrative templates version 5401, released on 6/12/2023.

📌Deployment options for the baseline:

IT Admins can apply baseline settings in different ways. Depending on the method(s) chosen different registry keys will be written and they will be observed in order of precedence: Office cloud policies will override ADMX/Group Policies which will override end user settings in the Trust Center.

• Cloud policies may be deployed with the Office cloud policy service for policies in HKCU.  Cloud policies apply to a user on any device accessing files in Office apps with their AAD account. In Office cloud policy service, you can create a filter for the Area column to display the current Security Baselines, and within each policy's context pane the recommended baseline setting is set by default. Learn more about Office cloud policy service.

• ADMX policies may be deployed with Microsoft Endpoint Manager (MEM) for both HKCU and HKLM policies. These settings are written to the same place as Group Policy, but managed from the cloud in MEM. There are two methods to create and deploy policy configurations: Administrative templates or the settings catalog.

• Group Policy may be deployed with on premise AD DS to deploy Group Policy Objects (GPO) to users and computers. The downloadable baseline package includes importable GPOs, a script to apply the GPOs to local policy, a script to import the GPOs into Active Directory Group Policy, updated custom administrative template (SecGuide.ADMX/L) file, all the recommended settings in spreadsheet form and a Policy Analyzer rules file.

📌GPOs included in the baseline:

Most organizations can implement the baseline’s recommended settings without any problems. However, there are a few settings that will cause operational issues for some organizations. We've broken out related groups of such settings into their own GPOs to make it easier for organizations to add or remove these restrictions as a set. The local-policy script (Baseline-LocalInstall.ps1) offers command-line options to control whether these GPOs are installed.

⚠️Download the content from the Microsoft Security Compliance Toolkit, test the recommended configurations, and implement as appropriate.

Tech community article: Security Baseline for M365 Apps for enterprise v2306 - Microsoft Community Hub

Credits for this article go to Rick Munck.