Enforcing baseline multi-factor authentication in Microsoft 365
What Microsoft Entra security defaults actually turn on, who it affects, and when a growing business should move to Conditional Access instead.
Multi-factor authentication (MFA) is one of the most effective controls against common identity attacks, especially alongside blocking legacy authentication. For most Microsoft 365 tenants without Microsoft Entra ID P1 or P2 licensing, the fastest starting point is a built-in setting called security defaults. You do not need to build a custom policy first.
This guide is based on our review of Microsoft’s current documentation for security defaults. It’s written for an admin deciding whether to turn it on, not as a substitute for testing the change in your own tenant.
What security defaults actually enables
Turning on security defaults for a Microsoft Entra tenant enables a fixed bundle of protections. There is no customization, only on or off:
- Every user is required to register for multi-factor authentication.
- Administrators must complete MFA every time they sign in.
- Other users are prompted for MFA when Microsoft’s systems judge it necessary, based on signals like location and device.
- Legacy authentication protocols (older mail clients, IMAP, SMTP, POP3) are blocked outright, since they can’t support MFA and are a common way attackers bypass it.
- Device code flow, an authentication method sometimes abused in phishing attempts, is blocked.
- Sign-ins to the Azure portal and related management tools require MFA regardless of role.
Since July 2024, new and existing tenants no longer get a 14-day grace period before MFA registration is enforced, so plan for a short adjustment period rather than a soft rollout.
Who this setting is for
Security defaults is aimed at organizations on Microsoft’s free identity tier that have not set up anything more specific. If your tenant already has Microsoft Entra ID P1 or P2 licensing, Microsoft’s guidance points you toward Conditional Access. It provides much more control over exceptions, break-glass accounts, and app-specific rules.
Turning it on
- Sign in to the Microsoft Entra admin center with at least the Conditional Access Administrator role.
- Go to Entra ID → Overview → Properties.
- Select Manage security defaults.
- Set Security defaults to Enabled and save.
Before you do, revoke existing sign-in sessions so everyone is prompted to register for MFA rather than continuing on an old session. Confirm that no admin account depends on a legacy mail client. Security defaults blocks it as soon as it is turned on.
What to tell staff first
Send a short notice before enabling it: staff will be asked to register a second sign-in method (Microsoft’s guidance points people to the Microsoft Authenticator app) the next time they sign in. A little warning avoids a flood of “is this a phishing attempt?” questions on day one.
When to move beyond it
Security defaults is a good baseline, not a permanent answer for a growing business. Once you are managing exceptions, such as a legacy line-of-business app that cannot handle MFA, a rule for a specific role, or risk-based sign-in policies, it is time to license Conditional Access and retire security defaults. Microsoft publishes managed Conditional Access policy templates that replicate the same baseline, so the move does not have to start from a blank page.
Where this fits into a broader review
MFA coverage is one part of a Microsoft 365 tenant, not the whole picture. Administrative role assignments, sharing defaults, and recovery paths also matter and interact with each other. Our Microsoft 365 Security Review & Hardening service looks at identity alongside those areas and stages changes carefully to avoid locking out an admin account.
Sources