Security Defaults Policy
Security defaults is a set of basic identity security mechanisms recommended by Microsoft. When enabled, these recommendations will be automatically enforced in your organization. Administrators and users will be better protected from common identity related attacks. Note: this will override some settings such as Conditional Access Policies.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Security defaults enabled | If set to true, Azure Active Directory security defaults is enabled for the tenant. Learn more |
Configure it
This baseline turns Microsoft’s all-or-nothing Security Defaults off, in favour of the finer-grained Conditional Access policies you deploy instead. Add it once the tenant already has Conditional Access baselines in place.
-
Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).
-
Turn Security defaults enabled off.
-
Save. Turn on Auto-remediation only once you’re confident Conditional Access is doing the job instead. If someone re-enables Security Defaults for a good reason, Auto-remediation silently undoes their change.
Check it worked
Passing means Entra ID → Overview → Properties → Manage security defaults shows Security defaults set to Disabled. If the tenant is licensed for Conditional Access and already has policies enabled, Microsoft’s page shows Security Defaults as unavailable to turn on instead, which also passes this baseline. Users see no change themselves; whatever your Conditional Access baselines require now applies in place of Microsoft’s fixed defaults.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.