setup example
microsoft 365: switch on the sign-in baseline
Security defaults turn on a second factor, block old mail protocols and protect the admin consoles, with no extra licence. The steps below keep the order that avoids a lockout.
what it is and when it fits
Security defaults are a set of sign-in rules that Microsoft makes available to every Entra tenant. They are on or off, with nothing to customize. Microsoft lists what they do: all users must register for multifactor authentication, administrators must use it, users must use it when necessary, legacy authentication protocols are blocked, device code flow is blocked and privileged activities such as access to the Azure portal are protected.
Microsoft says its own analysis shows that multifactor authentication and blocking legacy authentication stop more than 99.9% of common identity-related attacks. That is a vendor figure. Treat it as Microsoft’s own indication of why these settings come first.
The setting suits a company that has no complex exceptions. Once you need some, the same protections come back as Conditional Access policies, which can be customized.
fits: A company on Microsoft 365 or Entra ID that has no Conditional Access policies, or that is on the free tier of Entra ID licensing.
before you start
- licence
- Security defaults need none. Conditional Access needs at least Microsoft Entra ID P1, according to Microsoft's own comparison table.
- role
- At least Conditional Access Administrator, to change the setting.
- check first
- Security defaults are rolled out to new tenants at creation, and tenants created on or after 22 October 2019 might already have them on. Open the setting before you plan anything.
the steps, in this order
from open door to a sign-in baseline
- 1protect the way backtwo emergency accounts that meet the second-factor rule
- 2find the old routessign-in logs filtered on the legacy client apps
- 3tell peopleregister at Security Info with the Authenticator app
- 4turn it onSecurity defaults set to Enabled
- 5revoke and checkold sessions revoked, every administrator signs in once
when you need exceptions, the same protections move to Conditional Access
basis Microsoft Learn, security defaults. The order is practice.
- set up two emergency access accounts firstSecurity defaults are on or off with no customization, so the emergency accounts have to meet the second-factor requirement themselves. Microsoft recommends a passkey (FIDO2) for them. Do that, then come back.the emergency access page →
- find anyone still using old mail protocolsSecurity defaults block legacy authentication, including Exchange ActiveSync basic authentication. Microsoft's warning says to make sure administrators are not using older protocols before you enable them. The security defaults page links to guidance for devices and applications that send email, which is where this usually shows up.
Entra admin center > Entra ID > Monitoring & health > Sign-in logs, filter on Client Apphow to read the legacy sign-ins → - tell people what is comingUsers register through the Security Info link at myprofile.microsoft.com. Security defaults require the Microsoft Authenticator app with notifications, which show a number the user types into the app. Codes from the app, or from another OATH TOTP app, also work.
- turn it onSign in as at least Conditional Access Administrator, set Security defaults to Enabled and select Save.
Entra admin center > Entra ID > Overview > Properties > Manage security defaults - revoke existing sessions so people registerMicrosoft says administrators should revoke existing tokens, so that people who are already signed in have to authenticate again and register. The cmdlet it names is Revoke-MgUserSignInSession in the Microsoft Graph PowerShell SDK.
- have every administrator sign in onceAdministrators have to register before the rule applies to them. Microsoft also suggests separate accounts for administration and for daily work, which reduces how often administrators are prompted.
- when you need exceptions, move to Conditional AccessSet Security defaults to Disabled (not recommended) and turn on policies straight away. Microsoft says its Microsoft-managed Conditional Access policies keep the same protections: blocking legacy authentication, MFA for Azure management, MFA for administrators and MFA for all users. This path needs Entra ID P1.
Entra admin center > Entra ID > Overview > Properties > Manage security defaults
basis Microsoft Learn, security defaults, read on 2 November 2026. The order of the steps is practice.
how to tell it worked
- Sign in as an administrator in a private browser window. Microsoft says administrators are asked for a second factor every time they sign in once they have registered.
- Open the sign-in logs, filter on the legacy client apps and look at new attempts. They should stop succeeding.
- Look at the per-user MFA status page. Users show Disabled there, and Microsoft says that is the right status for people covered by security defaults.
what goes wrong
turning off an authentication method
Microsoft warns against disabling methods while security defaults are on, because it might lock you out of your own tenant. Leave all methods available to users enabled.
a copier or an old app that stops sending mail
Everything that signs in with an older protocol is blocked once the setting is on. Look in the sign-in logs first and fix each one.
device code flow stops working
Security defaults block device code flow. Microsoft says applications or devices that depend on it cannot complete sign-in while the setting is on. All new tenants block it from 1 July 2026.
the emergency accounts are not covered
Security defaults are on or off with no customization, so plan for the emergency accounts to meet the requirement themselves. Give the emergency accounts a method that satisfies the second-factor requirement, as the emergency access page describes.
the evidence it leaves
| show | owner | refresh |
|---|---|---|
| dated screenshot of the Security defaults setting, or of the Conditional Access policies that replaced it | head of IT | when it changes, and checked quarterly |
| list of administrator accounts and the second-factor method each one registered | head of IT | quarterly |
| sample of sign-in logs showing the second factor in use and legacy attempts failing | head of IT | quarterly |
| the decision to move from security defaults to Conditional Access, with the policies that replaced them | head of IT | when it happens |
basis practice. The rhythms are your choice.
the controls and rules it serves
- multi-factor authenticationNIS2 names multi-factor authentication where appropriate. This is the setting that turns it on for every account.
- privileged accessAdministrators are asked for a second factor every time, and Azure management needs one for everyone.
This page describes what the platform's maker documents for this one platform. It does not say the platform is the right choice for your company, and the same control exists elsewhere.
check it yourself
your next step
Open the sign-in logs today and filter on the legacy client apps, to see who would stop working.