# Security Defaults Policy

> Security defaults is a set of basic identity security mechanisms recommended by Microsoft.

Security defaults is a set of basic identity security mechanisms recommended by Microsoft. When enabled, these recommendations will be automatically enforced in your organization. Administrators and users will be better protected from common identity related attacks. Note: this will override some settings such as Conditional Access Policies.

## Settings this baseline controls

| Setting                   | What it does                                                                                                                                                                                                           |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Security defaults enabled | If set to true, Azure Active Directory security defaults is enabled for the tenant. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/identitysecuritydefaultsenforcementpolicy?view=graph-rest-beta) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline turns Microsoft's all-or-nothing Security Defaults off, in favour of the finer-grained Conditional Access policies you deploy instead. Add it once the tenant already has Conditional Access baselines in place.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Turn **Security defaults enabled** off.
3. Save. Turn on **Auto-remediation** only once you're confident Conditional Access is doing the job instead. If someone re-enables Security Defaults for a good reason, **Auto-remediation** silently undoes their change.

> **Caution:** Security Defaults and Conditional Access overlap but aren't identical: Security Defaults enforces MFA for everyone, with no way to make exceptions. Turn this off only once the tenant has its own Conditional Access policies covering MFA and legacy authentication (which need Entra ID P1 or P2); otherwise the tenant is left with neither protection in place.

## Check it worked

Passing means **Entra ID → Overview → Properties → Manage security defaults** shows Security defaults set to Disabled. If the tenant is licensed for Conditional Access and already has policies enabled, Microsoft's page shows Security Defaults as unavailable to turn on instead, which also passes this baseline. Users see no change themselves; whatever your Conditional Access baselines require now applies in place of Microsoft's fixed defaults.

## Standards this addresses

### CIS

- **M365 5.1.2.2** — CIS M365 Foundations Benchmark 5.1.2.2
- **v8 4.1** — CIS Controls v8 Safeguard 4.1

### NIST

- **PR.AC-1** — NIST CSF 2.0 PR.AC-1
- **PR.AC-4** — NIST CSF 2.0 PR.AC-4
- **IA-2** — NIST SP 800-53 IA-2

### ISO 27001

- **A.8.3** — ISO/IEC 27001:2022 Annex A.8.3

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)