Security defaults vs Conditional Access in Microsoft 365

Security defaults is a single setting in Microsoft Entra ID (the identity service behind Microsoft 365). Microsoft's documentation describes it as a preconfigured baseline for organizations that want better security but don't know where to start, and for tenants on the free tier of Entra ID licensing. Tenants created on or after October 22, 2019 may already have it on.

According to Microsoft Learn, enabling it does the following, with no options to tune:

• Requires every user to register for multifactor authentication (MFA). Microsoft removed the old 14-day registration grace period in 2024.
• Requires MFA every time someone in a listed administrator role signs in.
• Prompts ordinary users for MFA when Microsoft judges it necessary, based on location, device, role and task.
• Blocks legacy authentication protocols, which can't do MFA and are a common route for password spray.
• Requires MFA for Azure management tools (Azure portal, Azure PowerShell, Azure CLI).
• Blocks device code flow sign-ins, which attackers abuse in phishing.

Conditional Access is Entra ID's policy engine. Each policy says: for these users, signing in to these apps, under these conditions, require (or block) these things. Conditions include location, device platform, client app type, and, with the right licence, sign-in and user risk. Controls include MFA, an authentication strength such as phishing-resistant MFA, a compliant or hybrid-joined device, or a hard block.

That granularity is what most growing organizations end up needing. With Conditional Access you can exclude a scanner's service account from one policy without weakening all the others, require phishing-resistant sign-in only for administrators, block countries you never work from, or insist that company data is only reached from managed laptops. Security defaults can't do any of this. It's either on or off.

Entra ID P1 is included in several Microsoft 365 business and enterprise plans, so check what your current subscription includes before assuming you need to buy anything. Microsoft also states that the two can't be combined: creating Conditional Access policies prevents you from enabling security defaults, and to move to Conditional Access you must turn security defaults off.

Microsoft's own guidance is that if you hold Entra ID P1 or P2 licences, security defaults is probably not right for you. In practice we use a simple test:

• Stay on security defaults if you have no P1 licences, a small team, no shared devices or old scanners that send email, and nobody needs an exception. It's far better than nothing, and it's free.
• Move to Conditional Access if you already pay for P1 (often through Microsoft 365 Business Premium or an E3/E5 plan), if any device or app needs an exception, if you want to require managed devices, or if you need stronger sign-in methods for administrators.
• Move to Conditional Access if a cyber insurance questionnaire, client audit or regulator asks you to show which controls apply to whom. A written policy set is much easier to evidence than a single toggle.

1. 01

   Create two emergency access accounts first

   Microsoft recommends two cloud-only accounts on the .onmicrosoft.com domain with the Global Administrator role, protected with a phishing-resistant method such as a FIDO2 security key, and excluded from policies that block or restrict sign-in.

2. 02

   Build replacement policies in report-only mode

   Microsoft offers managed policies and templates that mirror security defaults: MFA for admins, MFA for all users, MFA for Azure management, and a legacy authentication block. Templates are created in report-only mode by default.

3. 03

   Read the report-only results

   In the Entra sign-in logs, open individual sign-ins and check the Report-only tab to see what each policy would have done. Look for service accounts, printers and line-of-business apps that would be blocked.

4. 04

   Disable security defaults and turn policies on in the same change window

   Per Microsoft Learn, security defaults is managed under Entra ID > Overview > Properties > Manage security defaults. Switch it off and move the replacement policies from Report-only to On straight away, not days later.

5. 05

   Revoke old sessions where needed

   Microsoft notes that revoking existing tokens forces previously signed-in users to authenticate again and register for MFA.

Sources: Microsoft Learn, 'Security defaults in Microsoft Entra ID' and 'Plan a Conditional Access deployment'. Menu names change; confirm the current path in the admin centre before you click.

• Confirm which Entra ID licence tier every user actually has.
• Two emergency access accounts created, tested, excluded from blocking policies and monitored.
• Every user registered for MFA before enforcement.
• Legacy authentication sign-ins identified and fixed (see our guide to blocking legacy authentication).
• Replacement policies tested in report-only mode for at least a week; Microsoft's deployment plan recommends a week per phase.
• Exclusions written down with an owner and a review date.
• Security defaults off only when equivalent policies are ready to go on.