Entra security defaults
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8c922f8 · +13 −5 lines · also on GitHub
⋯ 2 unchanged lines
33
description: Enable Microsoft Entra ID security defaults to strengthen your organization's security posture with preconfigured MFA requirements and legacy authentication protection.
44
ms.topic: how-to
55
ms.date: 07/21/2025
6
+ms.author: joflore
7
+author: MicrosoftGuyJFlo
68
manager: dougeby
79
ms.reviewer: sama
810
ms.custom:
⋯ 89 unchanged lines
98100
- Authentication Policy Administrator
99101
- Identity Governance Administrator
100102
103
+*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
104
+
101105
### Require users to do multifactor authentication when necessary
102106
103107
We tend to think that administrator accounts are the only accounts that need extra layers of authentication. Administrators have broad access to sensitive information and can make changes to subscription-wide settings. But attackers frequently target end users.
⋯ 5 unchanged lines
109113
> [!NOTE]
110114
> In case of [B2B direct connect](~/external-id/b2b-direct-connect-overview.md) users, any multifactor authentication requirement from security defaults enabled in resource tenant needs to be satisfied, including multifactor authentication registration by the direct connect user in their home tenant.
111115
116
+*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
117
+
112118
### Block legacy authentication protocols
113119
114120
To give your users easy access to your cloud apps, we support various authentication protocols, including legacy authentication. *Legacy authentication* is a term that refers to an authentication request made by:
⋯ 10 unchanged lines
125131
126132
- [How to set up a multifunction device or application to send email using Microsoft 365](/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
127133
134
+*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
135
+
128136
### Block device code flow
129137
130138
Device code flow is an authentication flow that lets users sign in to devices or applications that have limited input capabilities, such as devices without a browser or keyboard. Attackers can abuse device code flow in phishing attacks by tricking users into entering a code on another device.
⋯ 29 unchanged lines
160168
> [!NOTE]
161169
> The Microsoft Entra Connect / Microsoft Entra Cloud Sync synchronization accounts (or any security principal assigned to the "Directory Synchronization Accounts" role) are excluded from security defaults and aren't prompted to register for or perform multifactor authentication. Organizations shouldn't be using this account for other purposes.
162170
171
+*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
172
+
163173
## Deployment considerations
164174
165175
### Preparing your users
⋯ 15 unchanged lines
181191
182192
If your organization is a previous user of per-user based multifactor authentication, don't be alarmed to not see users in an **Enabled** or **Enforced** status if you look at the multifactor authentication status page. **Disabled** is the appropriate status for users who are using security defaults or Conditional Access based multifactor authentication.
183193
184
−### Disabling security defaults
194
+## Disabling security defaults
185195
186196
Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults.
187197
⋯ 13 unchanged lines
201211
| --- | --- | --- |
202212
| **Required licenses**| None | At least Microsoft Entra ID P1 |
203213
| **Customization**| No customization (on or off) | Fully customizable |
204
−| **Enabled by**| Microsoft or administrator | Administrator |
214
+| **Enabled by**| Microsoft or administrator | Microsoft or administrator |
205215
| **Complexity**| Simple to use | Fully customizable based on your requirements |
206216
207
−Recommended steps for moving from security defaults
208
−
209217
Organizations who would like to test out the features of Conditional Access can [sign up for a free trial](get-started-premium.md) to get started.
210218
211
−After administrators disable security defaults, organizations need to immediately enable Conditional Access policies to protect their organization. These policies need to include at least those in the [secure foundations category of Conditional Access templates](~/identity/conditional-access/concept-conditional-access-policy-common.md?tabs=secure-foundation#template-categories). Organizations with Microsoft Entra ID P2 licenses that include Microsoft Entra ID Protection can expand on this list to include [user and sign in risk-based policies](~/id-protection/howto-identity-protection-configure-risk-policies.md) to further strengthen their posture.
219
+After administrators disable security defaults, organizations should immediately enable Conditional Access policies to protect their organization. [Microsoft-managed Conditional Access policies](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) are available to maintain the same protections, covering blocking legacy authentication, requiring MFA for Azure management, requiring MFA for admins, and requiring MFA for all users. Organizations should review these policies and consider enabling more policies from the [secure foundations category of Conditional Access templates](~/identity/conditional-access/concept-conditional-access-policy-common.md?tabs=secure-foundation#template-categories). Organizations with Microsoft Entra ID P2 licenses that include Microsoft Entra ID Protection can expand on this list to include [user and sign in risk-based policies](~/id-protection/howto-identity-protection-configure-risk-policies.md) to further strengthen their posture.
212220
213221
[!INCLUDE [emergency-access-accounts](../includes/definitions/emergency-access-accounts.md)]
214222
⋯ 4 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.