📖 What is Security Defaults?
Security Defaults are a set of basic security settings applied to a Microsoft Entra ID tenant to protect against common identity-based attacks. They enforce multi-factor authentication (MFA) for all users and block legacy authentication protocols by default.
"Warning: Enabling Security Defaults disables the ability to create custom Conditional Access policies. You cannot use both simultaneously; you must choose one approach."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Security Defaults?
- ▸ Enforces multi-factor authentication (MFA) for all users, including administrators, requiring the Microsoft Authenticator app to prevent password-only identity attacks.
- ▸ Blocks legacy authentication protocols like POP, IMAP, and SMTP that cannot support MFA, significantly reducing the risk of credential stuffing.
- ▸ Provides a simplified, one-click security baseline for small organizations that lack the expertise or licensing to manage complex identity policies.
- ▸ Available to all Microsoft Entra ID tenants regardless of license level, ensuring basic protection for users without P1 or P2 subscriptions.
- ▸ Requires all administrative roles to use MFA, ensuring high-privilege accounts are protected by a second layer of security by default.
🎯 How does Security Defaults appear on the MS-102 Exam?
You may be asked to recommend a security baseline for a small organization with no Entra ID P1 licenses that needs to enforce MFA for all users.
A scenario might describe a company wanting to implement custom Conditional Access policies but finding the option disabled; you must identify that Security Defaults are currently enabled.
Expect questions where you must choose between Security Defaults and Conditional Access based on the organization's need for granular control versus a simple setup.
❓ Frequently Asked Questions
Can I exclude specific users from MFA when Security Defaults are enabled?
No. Security Defaults are an all-or-nothing setting. To exclude specific users or create granular exceptions, you must disable Security Defaults and implement Conditional Access policies instead.
What happens to legacy applications when Security Defaults are turned on?
Legacy applications relying on basic authentication will stop working. You must migrate these applications to modern authentication, such as OAuth 2.0, to maintain connectivity.
Which licensing tier is required to use Security Defaults?
No special licensing is required. Security Defaults are free for all Microsoft Entra ID tenants, making them the primary security option for those without P1 or P2 licenses.