{
  "id": "CB-M365-AUTH-002",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-002",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-002.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-002.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-002",
    "title": "Enable security defaults on tenants without Microsoft Entra ID P1",
    "finding": {
      "title": "Security defaults are disabled and no Conditional Access is available",
      "description": "Without Entra ID P1 the tenant cannot use Conditional Access, so with security defaults off nothing requires MFA or blocks legacy authentication."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "security-defaults",
      "mfa",
      "legacy-authentication",
      "entra-id-free"
    ],
    "applicability": {
      "conditions": "Only for tenants without Microsoft Entra ID P1.\n"
    },
    "description": "On a tenant without Microsoft Entra ID P1 (Entra ID Free, or Microsoft 365 plans that do not\ninclude P1), **Security defaults** are enabled. They require every user to register for MFA,\nrequire MFA for administrators at each sign-in and for other users when Microsoft considers it\nnecessary, block legacy authentication protocols and device code flow, and protect access to the\nAzure management endpoints.\n\nSecurity defaults cannot be tuned and cannot coexist with Conditional Access. Tenants with P1\nuse the Conditional Access controls of this standard instead (CB-M365-AUTH-001,\nCB-M365-AUTH-003, CB-M365-AUTH-004).\n",
    "rationale": "Conditional Access is a P1 feature. On a tenant without it, security defaults are the only\nmechanism that enforces MFA and blocks legacy protocols for everyone. Disabling them leaves\naccounts protected by a password alone, the first target of password spray.\n",
    "impact": "Every user must register Microsoft Authenticator (or another allowed method) at next sign-in,\nwith no grace period. Clients and devices that use legacy authentication or device code flow\nstop working. No exclusion is possible: a service account that cannot do MFA must move to a\nworkload identity or the tenant must buy P1.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Overview > Properties > Manage security defaults",
      "default_value": "Enabled on tenants created after October 2019, unless disabled",
      "recommended_value": "Enabled"
    },
    "audit": {
      "manual": "1. Check the licenses: in the Microsoft 365 admin center (https://admin.cloud.microsoft) as a\n   Global Reader, browse to **Billing** > **Licenses** and confirm that no subscription\n   includes Microsoft Entra ID P1 or P2. If one does, this control does not apply.\n2. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n3. Browse to **Entra ID** > **Overview** > **Properties** and select **Manage security\n   defaults**.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy | Select-Object IsEnabled`\n   (Graph: `GET https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy`).\n5. Fail if **Security defaults** is **Disabled** (`isEnabled` is `false`) on a tenant without\n   P1.\n"
    },
    "remediation": {
      "manual": "1. Make sure no administrator relies on legacy authentication or device code flow, and warn\n   users that they will be asked to register Microsoft Authenticator.\n2. Sign in to the Microsoft Entra admin center as at least a Conditional Access\n   Administrator.\n3. Browse to **Entra ID** > **Overview** > **Properties** and select **Manage security\n   defaults**.\n4. Set **Security defaults** to **Enabled** and select **Save**.\n5. Optionally revoke existing sessions (`Revoke-MgUserSignInSession`) so that every user\n   registers MFA at next sign-in.\nGraph equivalent: `Update-MgPolicyIdentitySecurityDefaultEnforcementPolicy -IsEnabled:$true`\n(`PATCH /policies/identitySecurityDefaultsEnforcementPolicy` with `{\"isEnabled\": true}`).\n",
      "rollback": "Set **Security defaults** to **Disabled**. Only do this after buying P1 and enabling the\nequivalent Conditional Access policies.\n"
    },
    "references": [
      {
        "title": "Security defaults in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/fundamentals/security-defaults",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(1)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2(2)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1110.003"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-001",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-003",
        "type": "related",
        "note": "Tenants with P1 replace security defaults with Conditional Access; both cannot be on at once."
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}