Deploy Microsoft 365 Lighthouse baselines

Note

The features described in this article are in Preview, are subject to change, and are only available to partners who meet the requirements. If your organization does not have Microsoft 365 Lighthouse, see Sign up for Microsoft 365 Lighthouse.

Microsoft 365 Lighthouse baselines let you deploy standard managed-tenant configurations to secure users, devices, and data within customer tenants. There are six default baseline configurations that come standard with Lighthouse:

  • Require MFA for admins
  • Require MFA for end users
  • Block Legacy Authentication
  • Set up Device Enrollment in Microsoft Endpoint Manager – Azure AD Join
  • Configure Defender Antivirus policy for Windows devices
  • Configure Compliance Policy for Windows devices

Before you begin

Make sure you and your customer tenants meet the requirements listed in Requirements for Microsoft 365 Lighthouse.

Learn more about the default baseline

Select Baselines from the left navigation pane to open the Baselines page. You'll see that the default baseline has already been added to the Default tenant group (all tenants). To view the default baseline configurations, select View baseline to open the Default baseline page. The configurations are listed as deployment steps. Select any of the deployment steps to view deployment details and user impact.

Screenshot of the Default baseline page.>.

Deploy a baseline configuration

  1. In the left navigation page, select Tenants to view a list of your onboarded tenants.

  2. Select the tenant you want to deploy the baseline configuration to.

  3. Select the Deployment Plans tab to see all the deployment steps from the baseline that have been added to the tenant's deployment plan.

  4. Select a deployment step to open the deployment step page.

  5. Select Apply to apply the selected deployment step to the tenant. If the deployment step indicates "This action requires a manual step", make sure to complete the manual step so the deployment step is applied correctly.

Overview of using baselines to deploy standard tenant configurations (article)
Microsoft 365 Lighthouse FAQ (article)