Entra security defaults
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 88fa8f7 · +5 −13 lines · also on GitHub
⋯ 2 unchanged lines
33
description: Enable Microsoft Entra ID security defaults to strengthen your organization's security posture with preconfigured MFA requirements and legacy authentication protection.
44
ms.topic: how-to
55
ms.date: 07/21/2025
6
−ms.author: joflore
7
−author: MicrosoftGuyJFlo
86
manager: dougeby
97
ms.reviewer: sama
108
ms.custom:
⋯ 89 unchanged lines
10098
- Authentication Policy Administrator
10199
- Identity Governance Administrator
102100
103
−*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
104
−
105101
### Require users to do multifactor authentication when necessary
106102
107103
We tend to think that administrator accounts are the only accounts that need extra layers of authentication. Administrators have broad access to sensitive information and can make changes to subscription-wide settings. But attackers frequently target end users.
⋯ 5 unchanged lines
113109
> [!NOTE]
114110
> In case of [B2B direct connect](~/external-id/b2b-direct-connect-overview.md) users, any multifactor authentication requirement from security defaults enabled in resource tenant needs to be satisfied, including multifactor authentication registration by the direct connect user in their home tenant.
115111
116
−*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
117
−
118112
### Block legacy authentication protocols
119113
120114
To give your users easy access to your cloud apps, we support various authentication protocols, including legacy authentication. *Legacy authentication* is a term that refers to an authentication request made by:
⋯ 10 unchanged lines
131125
132126
- [How to set up a multifunction device or application to send email using Microsoft 365](/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
133127
134
−*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
135
−
136128
### Block device code flow
137129
138130
Device code flow is an authentication flow that lets users sign in to devices or applications that have limited input capabilities, such as devices without a browser or keyboard. Attackers can abuse device code flow in phishing attacks by tricking users into entering a code on another device.
⋯ 29 unchanged lines
168160
> [!NOTE]
169161
> The Microsoft Entra Connect / Microsoft Entra Cloud Sync synchronization accounts (or any security principal assigned to the "Directory Synchronization Accounts" role) are excluded from security defaults and aren't prompted to register for or perform multifactor authentication. Organizations shouldn't be using this account for other purposes.
170162
171
−*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
172
−
173163
## Deployment considerations
174164
175165
### Preparing your users
⋯ 15 unchanged lines
191181
192182
If your organization is a previous user of per-user based multifactor authentication, don't be alarmed to not see users in an **Enabled** or **Enforced** status if you look at the multifactor authentication status page. **Disabled** is the appropriate status for users who are using security defaults or Conditional Access based multifactor authentication.
193183
194
−## Disabling security defaults
184
+### Disabling security defaults
195185
196186
Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults.
197187
⋯ 13 unchanged lines
211201
| --- | --- | --- |
212202
| **Required licenses**| None | At least Microsoft Entra ID P1 |
213203
| **Customization**| No customization (on or off) | Fully customizable |
214
−| **Enabled by**| Microsoft or administrator | Microsoft or administrator |
204
+| **Enabled by**| Microsoft or administrator | Administrator |
215205
| **Complexity**| Simple to use | Fully customizable based on your requirements |
216206
207
+Recommended steps for moving from security defaults
208
+
217209
Organizations who would like to test out the features of Conditional Access can [sign up for a free trial](get-started-premium.md) to get started.
218210
219
−After administrators disable security defaults, [Microsoft-managed Conditional Access policies](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) are automatically created in the tenant to maintain the same protections. These managed policies cover blocking legacy authentication, requiring MFA for Azure management, requiring MFA for admins, and requiring MFA for all users. Organizations should review these policies and consider enabling more policies from the [secure foundations category of Conditional Access templates](~/identity/conditional-access/concept-conditional-access-policy-common.md?tabs=secure-foundation#template-categories). Organizations with Microsoft Entra ID P2 licenses that include Microsoft Entra ID Protection can expand on this list to include [user and sign in risk-based policies](~/id-protection/howto-identity-protection-configure-risk-policies.md) to further strengthen their posture.
211
+After administrators disable security defaults, organizations need to immediately enable Conditional Access policies to protect their organization. These policies need to include at least those in the [secure foundations category of Conditional Access templates](~/identity/conditional-access/concept-conditional-access-policy-common.md?tabs=secure-foundation#template-categories). Organizations with Microsoft Entra ID P2 licenses that include Microsoft Entra ID Protection can expand on this list to include [user and sign in risk-based policies](~/id-protection/howto-identity-protection-configure-risk-policies.md) to further strengthen their posture.
220212
221213
[!INCLUDE [emergency-access-accounts](../includes/definitions/emergency-access-accounts.md)]
222214
⋯ 4 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.