Demo · Access Baseline
How well is sign-in protected in your tenant?
Watch Access Baseline check a made-up healthcare tenant against a best-practice, Zero Trust sign-in baseline: break-glass access, Conditional Access, passkeys and admin accounts, each finding with why it matters and what fixes it. The assessment only reads. Then watch it design and deploy the core Conditional Access policies, report-only on a pilot group, with device-bound keys only for privileged accounts, compare the policies already there with the baseline, and try it yourself.
What it checks
Six areas, each finding marked in place, partly in place, missing or to review, with why it matters and what to do.
- Break-glass accessEmergency accounts left out of every Conditional Access policy, in a group only Privileged Role Administrators can change, each with a security key.
- Conditional AccessLegacy sign-in and device code flow blocked, MFA for everyone, phishing-resistant MFA for admins, guests and Azure management, and policies that do nothing or sit in report-only.
- Authentication methodsPasskeys and Microsoft Authenticator on, Temporary Access Pass available, and text and voice codes off.
- How people sign inHow many have a passkey, Authenticator, only text codes, or nothing registered at all.
- Admin accountsAdmins without a passkey or security key, admins who rely on a synced passkey, and how many Global Administrators there are.
- Licences and your roleEntra ID P1 and P2, and a notice when you signed in with more access than the check needs.
What the demo shows
Contoso Health is made up, and its tenant has the gaps most real ones do: a break-glass group missed by one policy and not role-assignable, a break-glass account with no key, no block on device code flow, MFA for everyone still in report-only, admins on ordinary MFA, a leftover risk policy that targets no apps, text codes on, people with nothing registered and six Global Administrators. Two of its policies are older copies of the baseline that have drifted, CA200 and CA103, so Review shows how each differs from the baseline, with CA103 ticked for update because it misses the break-glass group. Then design and deploy the baseline on it. Nothing is really created or changed: the made-up tenant just gains the policies until you reload the page. Nothing is sent and nothing connects to Microsoft.
- The score and a plain verdict, with the six areas at a glance
- What to fix first, in order
- Passkey readiness and Conditional Access coverage
- Every finding with what was found, why it matters and what to do
- An AKC-branded report to save as a PDF, plus CSV and JSON
- The notice for signing in as Global Administrator
- Designing the baseline: break-glass group, privileged accounts, pilot group and policies
- The review of every value, with the passkey policy before and after and each policy's exact settings
- Existing policies compared with the baseline, setting by setting
- Update to the baseline, chosen per policy, changing only the settings the baseline owns
- Typing DEPLOY to confirm, then what was created and updated, with every new policy report-only
What you need for your own tenant
Request access at deploy.andykemp.com/baseline, then connect your tenant.
- Global ReaderAll the assessment needs. Security Reader reads everything but the authentication methods policy. Global Administrator works, and the page tells you a smaller role would do.
- Conditional Access AdministratorTo deploy the core policies. Add Groups Administrator for new groups, Privileged Role Administrator for the role-assignable break-glass and privileged accounts groups, and Authentication Policy Administrator for the passkey profile.
- Entra ID P1For Conditional Access. Without it the check still runs and says what P1 would add; P2 adds the risk policies and just-in-time admin roles.
- Consent to AKC Baseline DeployerThe assessment reads your directory, your policies and the sign-in methods report, and changes nothing. Deploying asks for its own permissions, only when you deploy.
- Your browser, nothing elseYour Microsoft tokens stay in the tab, and the report is made there. AKC never receives them or anything the check finds.