MC1246002 Low
Prevent/Fix: Microsoft Baseline Security Mode has automatically trigger Entra Conditional Access policy creation
Summary AI-generated
Draft Entra Conditional Access policies were unintentionally created for some tenants using Baseline Security Mode; a fix is rolling out and drafts will be removed automatically.
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1193689 Microsoft baseline security mode for Office, SharePoint, Exchange, Teams, and Entra
- MC1506733 Action may be required: Review who can create agents in Microsoft Entra
- MC1395007 Microsoft Entra: New service plans for Conditional Access and ID Protection for agents
- MC1481309 Microsoft Entra ID: Enhance protection of the authentication experience by blocking external script injection
- MC1303719 (Updated) Microsoft Entra: Upcoming changes to federatedTokenValidationPolicy default settings
- MC1506728 Microsoft Entra: Changes to AgentIdentity.CreateAsManager permission for agent identities
Original post from Microsoft
Problem detected: Microsoft Baseline Security Mode has automatically triggers Entra Conditional Access policy creation
Customers who accessed Baseline Security Mode in Microsoft 365 between November 2025 and early February 2026 might see two draft Microsoft Entra ID Conditional Access policies created in their tenant in a Disabled state. These policies are associated with Baseline Security Mode and might appear as created by the administrator who signed in to the Microsoft Baseline Security Mode page.
[How this will affect your organization:]
This behavior doesn't represent a security incident and has no effect on tenant security. The policies are in a disabled draft state.
[What you need to do to prepare:]
There's no action needed to prepare. A fix has rolled out to ensure policies are created only through explicit administrator action. Any unintentionally created policy drafts will be removed as part of addressing this issue.
[Learn more about Microsoft Baseline Security Mode]
Baseline Security Mode: https://learn.microsoft.com/en-us/microsoft-365/baseline-security-mode/baseline-security-mode-settings?view=o365-worldwide
Additional details from Microsoft
- Summary
- Between November 2025 and February 2026, Microsoft Baseline Security Mode automatically created two disabled draft Entra Conditional Access policies in some tenants. This is not a security issue, requires no action, and a fix will remove unintended drafts and prevent automatic creation.