Entra security defaults

This page's changes and edits · All guidance changes

Microsoft's edit · 21 Jul 2025 18:24 UTC

Freshness updates July1

Microsoft's commit message in MicrosoftDocs/entra-docs · commit f6b623d · +19 ~~−14~~ lines · also on GitHub

11 ---

2 −title: Providing a default level of security in Microsoft Entra ID

3 −description: Get protected from common identity threats using Microsoft Entra security defaults.

2 +title: Configure Security Defaults for Microsoft Entra ID

3 +description: Enable Microsoft Entra ID security defaults to strengthen your organization's security posture with preconfigured MFA requirements and legacy authentication protection.

44 ms.service: entra

55 ms.subservice: fundamentals

66 ms.topic: conceptual

7 −ms.date: 04/15/2024

7 +ms.date: 07/21/2025

88 ms.author: joflore

99 author: MicrosoftGuyJFlo

1010 manager: femila

1111 ms.reviewer: sama

12 −ms.custom: sfi-ga-nochange, sfi-image-nochange

12 +ms.custom:

13 + - sfi-ga-nochange, sfi-image-nochange

14 + - ai-gen-docs-bap

15 + - ai-gen-title

16 + - ai-seo-date:07/21/2025

17 + - ai-gen-description

1318 ---

1419 # Security defaults in Microsoft Entra ID

1520

⋯ 56 unchanged lines

7277 ### Require all users to register for Microsoft Entra multifactor authentication

7378

7479 > [!NOTE]

75 −> Starting July 29, 2024, new tenants and existing tenants had the 14-day grace period for users to register for MFA removed. We are making this change to help reduce the risk of account compromise during the 14-day window, as MFA can block over 99.2% of identity-based attacks.

80 +> Starting July 29, 2024, new tenants and existing tenants have the 14-day grace period for users to register for MFA removed. We made this change to help reduce the risk of account compromise during the 14-day window, as MFA can block over 99.2% of identity-based attacks.

7681

7782 When users sign in and are prompted to perform multifactor authentication, they see a screen providing them with a number to enter in the Microsoft Authenticator app. This measure helps prevent users from falling for MFA fatigue attacks.

7883

⋯ 1 unchanged line

8085

8186 ### Require administrators to do multifactor authentication

8287

83 −Administrators have increased access to your environment. Because of the power these highly privileged accounts have, you should treat them with special care. One common method to improve the protection of privileged accounts is to require a stronger form of account verification for sign-in, like requiring multifactor authentication.

88 +Administrators have more access to your environment. Because of the power these highly privileged accounts have, treat them with special care. One common method to improve the protection of privileged accounts is to require a stronger form of account verification for sign-in, like requiring multifactor authentication.

8489

8590 > [!TIP]

8691 > Recommendations for your admins:

⋯ 15 unchanged lines

102107 One common method to improve protection for all users is to require a stronger form of account verification, such as multifactor authentication, for everyone. After users complete registration, they'll be prompted for another authentication whenever necessary. Microsoft decides when a user is prompted for multifactor authentication, based on factors such as location, device, role, and task. This functionality protects all registered applications, including SaaS applications.

103108

104109 > [!NOTE]

105 −> In case of [B2B direct connect](~/external-id/b2b-direct-connect-overview.md) users, any multifactor authentication requirement from security defaults enabled in resource tenant will need to be satisfied, including multifactor authentication registration by the direct connect user in their home tenant.

110 +> In case of [B2B direct connect](~/external-id/b2b-direct-connect-overview.md) users, any multifactor authentication requirement from security defaults enabled in resource tenant needs to be satisfied, including multifactor authentication registration by the direct connect user in their home tenant.

106111

107112 ### Block legacy authentication protocols

108113

⋯ 34 unchanged lines

143148 This policy applies to all users who are accessing Azure Resource Manager services, whether they're an administrator or a user. This policy applies to Azure Resource Manager APIs such as accessing your subscription, VMs, storage accounts, and so on. This policy doesn't include Microsoft Entra ID or Microsoft Graph.

144149

145150 > [!NOTE]

146 −> Pre-2017 Exchange Online tenants have modern authentication disabled by default. In order to avoid the possibility of a login loop while authenticating through these tenants, you must [enable modern authentication](/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online).

151 +> Exchange Online tenants created before 2017 have modern authentication disabled by default. In order to avoid the possibility of a login loop while authenticating through these tenants, you must [enable modern authentication](/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online).

147152

148153 > [!NOTE]

149 −> The Microsoft Entra Connect / Microsoft Entra Cloud Sync synchronization accounts (or any security principal assigned to the "Directory Synchronization Accounts" role) are excluded from security defaults and will not be prompted to register for or perform multifactor authentication. Organizations should not be using this account for other purposes.

154 +> The Microsoft Entra Connect / Microsoft Entra Cloud Sync synchronization accounts (or any security principal assigned to the "Directory Synchronization Accounts" role) are excluded from security defaults and aren't prompted to register for or perform multifactor authentication. Organizations shouldn't be using this account for other purposes.

150155

151156 ## Deployment considerations

152157

⋯ 3 unchanged lines

156161

157162 ### Authentication methods

158163

159 −Security defaults users are required to register for and use multifactor authentication using the [Microsoft Authenticator app using notifications](~/identity/authentication/concept-authentication-authenticator-app.md). Users might use verification codes from the Microsoft Authenticator app but can only register using the notification option. Users can also use any third party application using [OATH TOTP](~/identity/authentication/concept-authentication-oath-tokens.md) to generate codes.

164 +Security defaults users are required to register for and use multifactor authentication using the [Microsoft Authenticator app using notifications](~/identity/authentication/concept-authentication-authenticator-app.md). Users might use verification codes from the Microsoft Authenticator app but can only register using the notification option. Users can also use any non-Microsoft application using [OATH TOTP](~/identity/authentication/concept-authentication-oath-tokens.md) to generate codes.

160165

161166 > [!WARNING]

162 −> Do not disable methods for your organization if you are using security defaults. Disabling methods may lead to locking yourself out of your tenant. Leave all **Methods available to users** enabled in the [MFA service settings portal](~/identity/authentication/howto-mfa-getstarted.md#choose-authentication-methods-for-mfa).

167 +> Don't disable methods for your organization if you're using security defaults. Disabling methods might lead to locking yourself out of your tenant. Leave all **Methods available to users** enabled in the [MFA service settings portal](~/identity/authentication/howto-mfa-getstarted.md#choose-authentication-methods-for-mfa).

163168

164169 ### B2B users

165170

⋯ 7 unchanged lines

173178

174179 Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults.

175180

176 −To disable security defaults in your directory:

181 +Disable security defaults in your directory:

177182

178183 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Conditional Access Administrator](/entra/identity/role-based-access-control/permissions-reference#conditional-access-administrator).

179184 1. Browse to **Entra ID** > **Overview** > **Properties**.

⋯ 12 unchanged lines

192197 | **Enabled by**| Microsoft or administrator | Administrator |

193198 | **Complexity**| Simple to use | Fully customizable based on your requirements |

194199

195 −Recommended steps when moving from security defaults

200 +Recommended steps for moving from security defaults

196201

197202 Organizations who would like to test out the features of Conditional Access can [sign up for a free trial](get-started-premium.md) to get started.

198203

199 −After administrators disable security defaults, organizations should immediately enable Conditional Access policies to protect their organization. These policies should include at least those policies in the [secure foundations category of Conditional Access templates](~/identity/conditional-access/concept-conditional-access-policy-common.md?tabs=secure-foundation#template-categories). Organizations with Microsoft Entra ID P2 licenses that include Microsoft Entra ID Protection can expand on this list to include [user and sign in risk-based policies](~/id-protection/howto-identity-protection-configure-risk-policies.md) to further strengthen their posture.

204 +After administrators disable security defaults, organizations need to immediately enable Conditional Access policies to protect their organization. These policies need to include at least those in the [secure foundations category of Conditional Access templates](~/identity/conditional-access/concept-conditional-access-policy-common.md?tabs=secure-foundation#template-categories). Organizations with Microsoft Entra ID P2 licenses that include Microsoft Entra ID Protection can expand on this list to include [user and sign in risk-based policies](~/id-protection/howto-identity-protection-configure-risk-policies.md) to further strengthen their posture.

200205

201206 [!INCLUDE [emergency-access-accounts](../includes/definitions/emergency-access-accounts.md)]

202207

⋯ 4 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.