Entra security defaults

Timelines and exceptions · All guidance changes

Entra · Official Microsoft guidanceObserved changes retained

Retained observation

Source metadata changed; retained article content is unchanged.

Documentation metadata only

Read the current Microsoft source · Link to this observation · Compare any two versions

Observation details · observed today 00:53 UTC

Observed by ChangeIntel: today 00:53 UTC
Source update metadata: 16 Oct 07:34 UTC
Microsoft's latest commit in that period: Remove section on managing individual Security Defaults (#14618) · committed 16 Oct 03:33 UTC · View diff
First observed on this installation: 5 Oct 17:50 UTC
Last successful check: today 00:53 UTC
Next check due: today 06:53 UTC

Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.

Watch this page to review its changes in My radar.

Timeline

From the capture of today 00:53 UTC

Every published date has passed 1 Jul 2026 most recent · 3 months ago

3 dates
11 undated sections
12 with conditions

Enforced by default1 Jul 2026 Now: On by default; an override or rollback still exists

22 Oct 2019 6 years agoon or after
- Enabling security defaultsMilestone1 condition
29 Jul 2024 2 years agostarting
- Require all users to register for Microsoft Entra multifactor authenticationMilestoneScope1 condition
1 Jul 2026 3 months agostartingEnforced by default
- Block device code flowMilestone

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

Revoke-MgUserSignInSession

Requirements, exceptions and scope

Who should use Conditional Access?Recommendation2 conditions2 passages
If you're an organization with Microsoft Entra ID P1 or P2 licenses, security defaults are probably not right for you.…
If your organization has complex…
Enabling security defaultsRequirement2 passages
Revoking active tokensScopeRecommendation1 condition1 passage
Revoke-MgUserSignInSession
Require administrators to do multifactor authenticationRequirement1 condition1 passage
Require users to do multifactor authentication when necessaryExceptionScope6 conditions3 passages
Block legacy authentication protocolsScope1 passage
Block device code flowRecommendation1 condition1 passage
Protect privileged activities like access to the Azure portalRequirementScope5 passages
Authentication methodsRequirementException1 condition1 passage
Disabling security defaultsRequirementRecommendation2 passages
Move from security defaults to Conditional AccessRequirementExceptionRecommendation1 condition3 passages

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

Observed history and review priority

Captured today 00:53 UTC; extracted today 00:54 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c.

Review priority. Previously extracted guidance is missing from a later capture · Extracted assertions require review · Applicability or exceptions require review

0 date changes and 0 condition changes across 2 compared revisions. Suggested check interval: 6 hours.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 4

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

today 00:53 UTC · 29 candidates
12 Oct 19:35 UTC · 29 candidates
6 Oct 17:57 UTC · 32 candidates
5 Oct 17:50 UTC · 32 candidates

Microsoft's edits

History on GitHub

Commits to the page's source in MicrosoftDocs/entra-docs, with Microsoft's own messages. Commit dates can be hours or days before Learn publishes the change. ChangeIntel keeps a copy of each diff, so an edit stays readable here if GitHub stops serving it. Read 18 Oct 23:18 UTC.

16 Oct 03:33 UTC Remove section on managing individual Security Defaults (#14618) Served on LearnView diff
14 Oct 16:35 UTC Introduce management of individual Security Defaults protections (#14600) View diff
30 Jun 23:52 UTC Update security defaults documentation View diff
17 Jun 19:27 UTC Roll back unconfirmed claims pending team clarification View diff
15 Jun 16:45 UTC [BULK UPDATE] User Story 573314: Ensure every doc in MSec repos has an author from MSec Docs (entra-docs-pr 2) (#13307) View diff
20 May 18:19 UTC managed-policies-052026 View diff
15 May 23:34 UTC Document device code flow blocking in security defaults View diff
30 Apr 16:23 UTC Update deprecated AzureAD PowerShell references View diff
26 Jan 21:08 UTC fixing caps View diff
26 Jan 19:34 UTC Clarify grace period for security defaults enforcement View diff
21 Jul 2025 18:24 UTC Freshness updates July1 View diff
25 Apr 2025 18:32 UTC [BULK] Microsoft Entra admin center left nav changes View diff
13 Mar 2025 15:55 UTC Update docs/fundamentals/security-defaults.md View diff
13 Mar 2025 15:51 UTC Update security-defaults.md View diff

8 metadata-only edits · author, dates or topic labels, no article text

26 Jun 18:13 UTC [BULK UPDATE - METADATA ONLY] Remove duplicate ownership metadata (#13675) Metadata onlyView diff
17 Jun 19:33 UTC Resolve merge conflict (take upstream date) Metadata onlyView diff
9 Apr 16:43 UTC Add #Customer Intent to how-to articles in fundamentals Metadata onlyView diff
25 Feb 21:26 UTC [BULK UPDATE] Metadata: Move author/ms.author/manager/ms.service/ms.subservice to folder level (1/5) Metadata onlyView diff
31 Jul 2025 07:05 UTC Bulk update ms.topic, folder: architecture,external-id,fundamentals,global-secure-access,id-governance,id-protection,identity Metadata onlyView diff
24 Jul 2025 20:25 UTC [BULK] Update manager name Metadata onlyView diff
26 May 2025 22:47 UTC adding image meta data Metadata onlyView diff
21 May 2025 16:35 UTC [ms-custom] Add MS Custom to entra-pr Metadata onlyView diff

No related evidence found in this installation's recent collection. This does not establish that no announcement exists.

Retained observations

today 00:53 UTC · shown above
12 Oct 19:35 UTC
8 removed passages (about 50 words). The changed wording mentions prerequisites. Review the source to confirm the effect.
6 Oct 17:57 UTC
Source metadata changed; retained article content is unchanged.
5 Oct 17:50 UTC
Baseline for retained history; no earlier retained text to compare.

What changed

First observed 18 Oct 2026

No field changes in the recorded history.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.