Baseline Questions

Common Reasons for Failures

• 1.
  Configuration doesn't match expected state

  For example, PA-01 expects 2-4 Global Administrators. If you have 5, the control fails.

• 2.
  Missing Conditional Access policy

  Controls like ID-02 (Block Legacy Auth) or CA-01 (Require MFA) need a specific CA policy to exist and be enabled.

• 3.
  Threshold not met

  ID-01 (MFA Registration) requires 95%+ of users to have MFA registered. Even 94% counts as failing.

• 4.
  Recent configuration change (drift)

  Someone may have changed the setting since your last passing scan. Check the drift timeline.

How to Investigate

1. Click on the failing control to expand its details
2. Read the "Expected State" section to understand what TrueConfig is checking
3. Compare against your current configuration in Entra admin center
4. Check the "Remediation" section for step-by-step fix instructions
5. Review drift events to see if something recently changed

Automatic Exclusions

TrueConfig automatically excludes certain accounts from evaluation:

• •Break-glass accounts — Accounts following naming patterns like "BreakGlass", "EmergencyAccess", or "BG-" are excluded from controls like MFA requirements
• •Service accounts — Non-interactive accounts are excluded from user-focused controls
• •Directory sync accounts — Azure AD Connect accounts are handled separately

Manual Exclusions

To exclude specific users or groups from control evaluation:

1. Go to Tenant Settings → Exclusions
2. Click Add Exclusion
3. Select the control(s) to exclude from
4. Choose users or groups to exclude
5. Add a justification (required for audit trail)
6. Click Save

Common Reasons

• 1.
  Missing license

  Some controls require specific Microsoft 365 licenses. For example, PIM-related controls require Entra ID P2 or Entra ID Governance licenses.

  License requirements by control type:

  • • PIM controls → Entra ID P2
  • • Access reviews → Entra ID P2 or Governance
  • • Conditional Access → Entra ID P1+
  • • Information Protection → E5 or E5 Security
• 2.
  Feature not enabled

  Controls that evaluate PIM show as N/A if PIM isn't enabled in your tenant.

• 3.
  No applicable objects

  A control evaluating guest users shows N/A if you have no guest users in your tenant.

• 4.
  Baseline level mismatch

  Controls only evaluate if your baseline level includes them. Level 1 doesn't evaluate Level 2+ controls.

Available Levels

To Change Your Baseline Level

1. Go to Tenant Settings → Baseline Configuration
2. Review the comparison of your current level vs. the new level
3. Click Change Level and select the desired level
4. Review the list of new controls that will be evaluated
5. Confirm the change
6. A new scan will run automatically to evaluate against the new baseline

Why Counts Change

• 1.
  New controls added

  TrueConfig adds new controls when Microsoft releases new security features or when new attack vectors emerge.

• 2.
  Controls retired

  Occasionally, controls are retired when Microsoft deprecates a feature or when a control becomes redundant.

• 3.
  Controls split or merged

  A single control may be split into multiple more specific controls, or multiple related controls may be merged.

• 4.
  Level reassignment

  A control may move from Level 2 to Level 1 (or vice versa) based on updated risk assessments.

What to Expect

• •Release notes accompany any control library updates
• •New controls start with a 7-day grace period before affecting your posture score
• •Historical data is preserved — you can compare against previous baselines
• •In-app notifications alert you to significant baseline changes