Entra security defaults
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit a454cd9 · +11 −5 lines · also on GitHub
⋯ 99 unchanged lines
100100
- Authentication Policy Administrator
101101
- Identity Governance Administrator
102102
103
+*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
104
+
103105
### Require users to do multifactor authentication when necessary
104106
105107
We tend to think that administrator accounts are the only accounts that need extra layers of authentication. Administrators have broad access to sensitive information and can make changes to subscription-wide settings. But attackers frequently target end users.
⋯ 5 unchanged lines
111113
> [!NOTE]
112114
> In case of [B2B direct connect](~/external-id/b2b-direct-connect-overview.md) users, any multifactor authentication requirement from security defaults enabled in resource tenant needs to be satisfied, including multifactor authentication registration by the direct connect user in their home tenant.
113115
116
+*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
117
+
114118
### Block legacy authentication protocols
115119
116120
To give your users easy access to your cloud apps, we support various authentication protocols, including legacy authentication. *Legacy authentication* is a term that refers to an authentication request made by:
⋯ 10 unchanged lines
127131
128132
- [How to set up a multifunction device or application to send email using Microsoft 365](/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
129133
134
+*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
135
+
130136
### Block device code flow
131137
132138
Device code flow is an authentication flow that lets users sign in to devices or applications that have limited input capabilities, such as devices without a browser or keyboard. Attackers can abuse device code flow in phishing attacks by tricking users into entering a code on another device.
⋯ 29 unchanged lines
162168
> [!NOTE]
163169
> The Microsoft Entra Connect / Microsoft Entra Cloud Sync synchronization accounts (or any security principal assigned to the "Directory Synchronization Accounts" role) are excluded from security defaults and aren't prompted to register for or perform multifactor authentication. Organizations shouldn't be using this account for other purposes.
164170
171
+*Also available as a [Microsoft-managed Conditional Access policy](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) if you disable security defaults.*
172
+
165173
## Deployment considerations
166174
167175
### Preparing your users
⋯ 15 unchanged lines
183191
184192
If your organization is a previous user of per-user based multifactor authentication, don't be alarmed to not see users in an **Enabled** or **Enforced** status if you look at the multifactor authentication status page. **Disabled** is the appropriate status for users who are using security defaults or Conditional Access based multifactor authentication.
185193
186
−### Disabling security defaults
194
+## Disabling security defaults
187195
188196
Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults.
189197
⋯ 13 unchanged lines
203211
| --- | --- | --- |
204212
| **Required licenses**| None | At least Microsoft Entra ID P1 |
205213
| **Customization**| No customization (on or off) | Fully customizable |
206
−| **Enabled by**| Microsoft or administrator | Administrator |
214
+| **Enabled by**| Microsoft or administrator | Microsoft or administrator |
207215
| **Complexity**| Simple to use | Fully customizable based on your requirements |
208216
209
−Recommended steps for moving from security defaults
210
−
211217
Organizations who would like to test out the features of Conditional Access can [sign up for a free trial](get-started-premium.md) to get started.
212218
213
−After administrators disable security defaults, organizations need to immediately enable Conditional Access policies to protect their organization. These policies need to include at least those in the [secure foundations category of Conditional Access templates](~/identity/conditional-access/concept-conditional-access-policy-common.md?tabs=secure-foundation#template-categories). Organizations with Microsoft Entra ID P2 licenses that include Microsoft Entra ID Protection can expand on this list to include [user and sign in risk-based policies](~/id-protection/howto-identity-protection-configure-risk-policies.md) to further strengthen their posture.
219
+After administrators disable security defaults, [Microsoft-managed Conditional Access policies](~/identity/conditional-access/managed-policies.md#upgrade-from-security-defaults) are automatically created in the tenant to maintain the same protections. These managed policies cover blocking legacy authentication, requiring MFA for Azure management, requiring MFA for admins, and requiring MFA for all users. Organizations should review these policies and consider enabling more policies from the [secure foundations category of Conditional Access templates](~/identity/conditional-access/concept-conditional-access-policy-common.md?tabs=secure-foundation#template-categories). Organizations with Microsoft Entra ID P2 licenses that include Microsoft Entra ID Protection can expand on this list to include [user and sign in risk-based policies](~/id-protection/howto-identity-protection-configure-risk-policies.md) to further strengthen their posture.
214220
215221
[!INCLUDE [emergency-access-accounts](../includes/definitions/emergency-access-accounts.md)]
216222
⋯ 4 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.