The report says "zero impacts", and that does not mean nobody uses it

Microsoft has put a screen in the Microsoft 365 admin center with twenty-one switches that turn things off: basic authentication, EWS, ActiveX, SharePoint's old protocols, Publisher. It is called Baseline Security Mode and the official guidance says how to use it: run the impact report for each setting and, if it comes back at zero, turn it on. Before touching any of them there is another figure worth having in front of you: Windows Office clients below version 2510 do not send the simulation mode telemetry signals that feed that report.

We think the screen is a good idea and will not pretend otherwise: it gathers in one place settings that until now lived scattered across Set-OrganizationConfig, Set-SPOTenant, the Office cloud policy service and three separate portals. That is real work removed. What it does not gather —because it does not have it— is an inventory of what your company actually uses. And without that inventory, a switch with a zero report is a bet with a nice face on it.

Where it is and what it is, in two lines

Microsoft 365 admin center → Settings → Org settings → Security and privacy tab → Baseline Security Mode. It is available on all Microsoft 365 subscriptions and plans, with no extra licence, and it covers Microsoft 365 apps, SharePoint and OneDrive, Teams, Exchange Online and the Entra identity platform. Each setting is turned on and off independently; there is no big button that puts everything into "secure".

One operational detail you notice on day one: no workload administrator can turn all twenty-one on. The identity ones need Security administrator or Conditional Access administrator; the app credentials one also accepts Application administrator; the consent one accepts Security administrator or Privileged Role administrator; the files block is signed off by the SharePoint administrator and the rooms block by the Teams administrator. If those roles sit with four different people at your place, this screen comes out of a meeting.

The twenty-one switches, counted

We counted them ourselves against the official settings page, in its 17 April 2026 version. They come in three blocks:

Two things you see reading the table and not the screenshot. First: two of the twelve "authentication" ones are not authentication —SharePoint custom scripts and the app store are governance, not identity— and they sit there because that is how the page groups them. Second: one of the twenty-one no longer changes anything. The legacy browser authentication one over RPS was deprecated for enterprise tenants in October 2025, and the page itself says the protocol no longer functions and that the parameter that enabled it —LegacyBrowserAuthProtocolsEnabled— no longer accepts the value true. It is still in the list. It counts as twenty-one and twenty of them work.

Three of them block nothing: they block the Trust Center

This is worth understanding before selling a security plan internally, because otherwise you promise an improvement that was already there. ActiveX is already blocked by default in Microsoft 365 apps: if nobody has configured anything, the effective value is "disable all controls without notification". Basic authentication is blocked by default. FPRPC is blocked by default in favour of HTTPS. What those three switches actually do is take away the user's ability to override it from the Trust Center: the option goes grey.

It is not nothing —removing the "continue anyway" is half the work of any control— but it is a different sentence in the committee minutes: what you are pinning is a block that was already there. And it takes exceptions: the ActiveX setting can be excluded for specific users or groups by creating a policy configuration with higher priority than the tenant one for those people. A warning: the page contradicts itself here, because the steps say to set the Disable All ActiveX policy to "Enabled" and the revert paragraph leaves it at "Not configured". Read both before you apply it.

The "zero impacts" and version 2510

The official usage recommendation is three lines long and it is sensible: run the impact report for each setting; if it shows zero impacts, turn it on; if critical dependencies exist, do not turn it on and plan instead. Now the other page, the minimum versions one for Microsoft 365 for Windows: Office app settings are implemented through cloud policy, the recommended minimum version is 2510, and earlier versions do not send the telemetry signals the admin center needs to display simulation mode data. Neither page actually says that "simulation mode" and "impact report" are the same screen: that reading is ours, and the rest of this rests on it.

Both sentences are true and they live on different pages. Together they say that on an estate with old Office, the report for the app settings can come back at zero because the clients are silent, not because nobody opens sheets with ActiveX in them. Under the "if it is zero, turn it on" rule, that is precisely the road to closing something that is in use and finding out by phone.

It is not a universal zero: this affects the nine settings applied in the Office client (the six file ones, plus basic authentication, insecure protocols and FPRPC), which are exactly the ones that minimum-versions table lists. The EWS, RPS and IDCRL reports come out of the service rather than the client —the versions page only covers those nine— so they do not depend on your Office version. And there is a second detail: EWS usage data is collected and aggregated weekly, not daily. A job that runs on the 1st of every month is not in the report for whichever week you happen to look at.

The minimum versions, in case you have to look at the estate before the screen: Publisher, insecure protocols and FPRPC need 2510; OLE Graph and OrgChart objects, 2503; old formats in Protected View, 2506; ActiveX, DDE and basic authentication prompts work on any supported version. And one welcome note: if the policy is set in both Group Policy and cloud policy, cloud policy wins.

What actually breaks when you switch off EWS

This is the big switch. The documentation lists it under the EWS requirements heading, with wording worth reading literally: what follows are features that stop working "when you enable baseline security mode settings". We copy it without decoration because it is the list you take to the meeting:

And one qualification the documentation makes: EWS is also used by Microsoft's own features, not just third-party applications. That is what the work of removing dependencies from Outlook, Office, Teams and Dynamics is about, and it is still under way. The switch does not discriminate: if you turn it off, you turn it off for everyone, and exceptions then get made in PowerShell with the list of Entra application IDs.

Two Conditional Access policies nobody created

This paragraph is for anyone auditing who touched what. Customers who accessed Baseline Security Mode between November 2025 and early February 2026 may have two draft Conditional Access policies in their tenant, in a disabled state, credited to the administrator who signed in to the page. Microsoft says so in the documentation itself, clarifies that it is not a security incident, that they are disabled, that a fix is in progress so policies are only created through explicit admin action, and that it will remove them with prior notice.

We note it for a practical reason: in a Conditional Access review, a draft policy nobody remembers creating turns into half an hour of awkward questions and, sometimes, a call to the client. Now there is a documented explanation with dates that rules it out in a minute.

The order we do it in

When we do not turn it on

We do not touch the EWS one if there is a hybrid Exchange that does not speak REST yet, if there is on-premises Dynamics synchronising mailboxes, or if the company shares calendars with clients or subsidiaries in other tenants. Not out of generic caution: because those are three things the documentation says stop working, and none of the three is a minor ticket. Nor the managed-devices one for Teams Rooms, if the rooms are not enrolled in device management yet: you would leave the room unable to sign in on Monday morning.

And one thing the screen does not say in large type is worth being clear about: this does not replace Conditional Access. The page itself points, in its footer, to security defaults and Microsoft-managed policies. Baseline Security Mode closes old protocols and surfaces; who signs in, from where and on what device is still decided in Conditional Access policies. They are different layers, and it pays not to minute one as though it were the other.

The switch whose date you do not set

Nineteen of these switches you flip when you choose to, or never. Publisher brings its own date —October 2026, out of Microsoft 365— and the RPS one no longer changes anything. And the EWS one carries a difference that changes the whole priority: Microsoft starts switching it off on its own in October 2026 and switches it off entirely in April 2027. There you are not deciding whether: you are deciding whether you find out early or late. We already wrote about the useful date in that calendar —which is not 1 October— two weeks ago, and it still stands.

Sources (consulted on 14 August 2026): the full list of settings, the count by block, required roles, availability on all plans, the usage recommendation ("if the setting displays zero impacts, turn on that setting"), the notice about two draft Conditional Access policies created between November 2025 and early February 2026, build 16.0.19725 and its arrival on Semi-Annual Enterprise Channel in July 2026, the Teams panels version, Publisher's removal in October 2026, the 24 hours for RPS and IDCRL and the list of what stops working when EWS is switched off — "Baseline security mode settings" on Microsoft Learn, 17 April 2026 version; the recommended minimum version 2510, per-setting versions (2503, 2506, 2510) and the fact that earlier versions do not send simulation mode telemetry, plus cloud policy taking precedence over Group Policy — "Minimum versions for Baseline Security Mode settings in Office"; weekly aggregation of EWS usage data, the CSV report of apps calling EWS and PowerShell exceptions — "Block access to Exchange Web Services (EWS)"; ActiveX default behaviour, the Trust Center lockout and group exclusions via the Disable All ActiveX policy — "Block ActiveX controls in Microsoft 365 apps"; basic authentication blocked by default and the equivalent cloud policy settings — "Block Basic authentication in Microsoft 365 apps"; the October 2026 and April 2027 calendar and EWS dependencies in Microsoft products — "Deprecation of Exchange Web Services in Exchange Online"; the organisation parameters quoted — the Set-OrganizationConfig reference. The count of twenty-one settings is ours, made across the tables on that page, discounting the two Room devices subsections that repeat rows already counted; the admin center may group them differently. Photo: "Western Electric 555 PBX switchboard, Telephone Museum, Waltham", public domain (CC0), via Wikimedia Commons.