Merge pull request #77017 from MicrosoftGuyJFlo/AdminBaseline

[Azure AD] Conditional access - Hotfix Baseline admin policy update

Author: GitHubber17

articles/active-directory/conditional-access/baseline-protection.md

@@ -1,5 +1,5 @@
 ---
-title: What is a baseline protection in Azure Active Directory conditional access? - preview | Microsoft Docs
+title: What is a baseline protection in Azure Active Directory conditional access? | Microsoft Docs
 description: Learn how baseline protection ensures that you have at least the baseline level of security enabled in your Azure Active Directory environment. 
 services: active-directory
 keywords: conditional access to apps, conditional access with Azure AD, secure access to company resources, conditional access policies
@@ -21,40 +21,32 @@ ms.reviewer: nigu
 
 ms.collection: M365-identity-device-management
 ---
-# What is baseline protection (preview)?  
+# What is baseline protection?
 
 In the last year, identity attacks have increased by 300%. To protect your environment from the ever-increasing attacks, Azure Active Directory (Azure AD) introduces a new feature called baseline protection. Baseline protection is a set of predefined [conditional access policies](../active-directory-conditional-access-azure-portal.md). The goal of these policies is to ensure that you have at least the baseline level of security enabled in all editions of Azure AD. 
 
 This article provides you with an overview of baseline protection in Azure Active Directory.
-
-
 
 ## Require MFA for admins
 
 Users with access to privileged accounts have unrestricted access to your environment. Due to the power these accounts have, you should treat them with special care. One common method to improve the protection of privileged accounts is to require a stronger form of account verification when they are used to sign-in. In Azure Active Directory, you can get a stronger account verification by requiring multi-factor authentication (MFA).  
 
-**Require MFA for admins** is a baseline policy that requires MFA for the following directory roles: 
-
-- Global administrator  
-
-- SharePoint administrator  
-
-- Exchange administrator  
-
-- Conditional access administrator  
-
-- Security administrator  
+**Require MFA for admins** is a baseline policy that requires MFA for the following directory roles:
 
+* Global administrator
+* SharePoint administrator
+* Exchange administrator
+* Conditional access administrator
+* Security administrator
+* Helpdesk administrator / Password administrator
+* Billing administrator
+* User administrator
 
 ![Azure Active Directory](./media/baseline-protection/01.png)
 
 This baseline policy provides you with the option to exclude users. You might want to exclude one *[emergency-access administrative account](../users-groups-roles/directory-emergency-access.md)* to ensure you are not locked out of the tenant.
 
-
-## Enable a baseline policy 
-
-While baseline policies are in preview, they are by default not activated. You need to manually enable a policy if you want to activate it. If you explicitly enable the baseline policies at the preview stage, they will remain active when this feature reaches general availability. The planned behavior change is the reason why, in addition to activate and deactivate, you have a third option to set the state of a policy: **Automatically enable policy in the future**. By selecting this option, you can leave the policies disabled during preview, but have Microsoft enable them automatically when this feature reaches general availability. If you do not explicitly enable baseline policies now, and do not select the **Automatically enable policy in the future** option, the policies will remain disabled when this feature reaches general availability.
-
+## Enable a baseline policy
 
 **To enable a baseline policy:**  
 
@@ -73,9 +65,6 @@ While baseline policies are in preview, they are by default not activated. You n
 5. To enable the policy, click **Use policy immediately**.
 
 6. Click **Save**. 
- 
-  
- 
 
 ## What you should know 
 
@@ -87,14 +76,10 @@ If you have privileged accounts that are used in your scripts, you should replac
 
 Baseline policies apply to legacy authentication flows like POP, IMAP, older Office desktop client. 
 
-
-
-
 ## Next steps
 
 For more information, see:
 
 - [Five steps to securing your identity infrastructure](https://docs.microsoft.com/azure/security/azure-ad-secure-steps)
 
 - [What is conditional access in Azure Active Directory?](overview.md) 
-