Enable security defaults on tenants without Microsoft Entra ID P1

Description

On a tenant without Microsoft Entra ID P1 (Entra ID Free, or Microsoft 365 plans that do not include P1), Security defaults are enabled. They require every user to register for MFA, require MFA for administrators at each sign-in and for other users when Microsoft considers it necessary, block legacy authentication protocols and device code flow, and protect access to the Azure management endpoints.

Security defaults cannot be tuned and cannot coexist with Conditional Access. Tenants with P1 use the Conditional Access controls of this standard instead (CB-M365-AUTH-001, CB-M365-AUTH-003, CB-M365-AUTH-004).

Rationale

Conditional Access is a P1 feature. On a tenant without it, security defaults are the only mechanism that enforces MFA and blocks legacy protocols for everyone. Disabling them leaves accounts protected by a password alone, the first target of password spray.

Impact

Every user must register Microsoft Authenticator (or another allowed method) at next sign-in, with no grace period. Clients and devices that use legacy authentication or device code flow stop working. No exclusion is possible: a service account that cannot do MFA must move to a workload identity or the tenant must buy P1.

Applies when

Only for tenants without Microsoft Entra ID P1.

Setting

Audit

1. Check the licenses: in the Microsoft 365 admin center (https://admin.cloud.microsoft) as a Global Reader, browse to Billing > Licenses and confirm that no subscription includes Microsoft Entra ID P1 or P2. If one does, this control does not apply.
2. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
3. Browse to Entra ID > Overview > Properties and select Manage security defaults.
4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy | Select-Object IsEnabled (Graph: GET https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy).
5. Fail if Security defaults is Disabled (isEnabled is false) on a tenant without P1.

Remediation

1. Make sure no administrator relies on legacy authentication or device code flow, and warn users that they will be asked to register Microsoft Authenticator.
2. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
3. Browse to Entra ID > Overview > Properties and select Manage security defaults.
4. Set Security defaults to Enabled and select Save.
5. Optionally revoke existing sessions (Revoke-MgUserSignInSession) so that every user registers MFA at next sign-in. Graph equivalent: Update-MgPolicyIdentitySecurityDefaultEnforcementPolicy -IsEnabled:$true (PATCH /policies/identitySecurityDefaultsEnforcementPolicy with {"isEnabled": true}).

Rollback

Set Security defaults to Disabled. Only do this after buying P1 and enabling the equivalent Conditional Access policies.

References

• Security defaults in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-001 Block legacy authentication with Conditional Access
• related CB-M365-AUTH-003 Require MFA for all users on all resources Tenants with P1 replace security defaults with Conditional Access; both cannot be on at once.

People and lifecycle