📖 What is Microsoft Entra ID Security Defaults?
Microsoft Entra ID Security Defaults are a set of basic security settings that Microsoft applies to tenants to provide a baseline level of protection. These settings require multi-factor authentication (MFA) for all users and block legacy authentication protocols that are more susceptible to attack.
"Security Defaults are an 'all-or-nothing' setting; if you need granular control via Conditional Access, you must disable Security Defaults first."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Entra ID Security Defaults?
- ▸ Mandatory MFA for all users, especially privileged accounts, ensuring that identity theft is mitigated by requiring a second form of verification.
- ▸ Blocking legacy authentication protocols like POP, IMAP, and SMTP, which are highly vulnerable to password spray attacks and do not support MFA.
- ▸ Automatic enablement of security alerts to notify administrators of suspicious sign-in activity or potential account compromises within the Entra ID tenant.
- ▸ A binary 'all-or-nothing' configuration that applies globally, meaning it cannot be customized for specific users, groups, or device conditions.
- ▸ Mutual exclusivity with Conditional Access; you must disable Security Defaults to implement granular, context-aware access policies for your organization.
🎯 How does Microsoft Entra ID Security Defaults appear on the MS-102 Exam?
You may be asked to recommend the fastest way to implement a baseline security posture for a small organization that lacks the budget for Entra ID P1 licenses.
A scenario might describe a need to exclude a specific service account from MFA; you must identify that Security Defaults must be disabled to achieve this.
Expect questions where an administrator is unable to configure Conditional Access policies, requiring you to identify that Security Defaults are currently enabled and blocking them.
❓ Frequently Asked Questions
Can I exclude a specific user or group from MFA while Security Defaults are enabled?
No. Security Defaults are a global setting. To exclude specific users or create exceptions, you must disable Security Defaults and implement Conditional Access policies instead.
What happens to legacy applications when Security Defaults are turned on?
Applications using legacy protocols like IMAP or POP will stop working because these protocols are blocked. You must migrate these applications to Modern Authentication to maintain connectivity.
Do I need a paid license to use Security Defaults?
No, Security Defaults are available for all Microsoft Entra ID tenants regardless of license level, making them an ideal starting point for basic security.