Identity Best Practices and Security Defaults

Securing identity is the first line of defence in any cloud environment. This lesson brings together the concepts from the entire course into a set of actionable best practices and introduces Security Defaults — the baseline protection available to every Entra ID tenant.

---

Security Defaults

Security Defaults are a set of pre-configured security settings that Microsoft provides for all Entra ID tenants. They are designed for organisations that do not yet have Conditional Access policies and need immediate, baseline protection.

What Security Defaults Enforce

Setting	Description
Require MFA registration	All users must register for MFA within 14 days
Require MFA for admins	All users with admin roles must perform MFA at every sign-in
Require MFA when necessary	All users are challenged for MFA based on risk signals
Block legacy authentication	Protocols that do not support MFA (POP, IMAP, SMTP basic) are blocked
Protect privileged activities	Access to the Azure portal, Azure CLI, and PowerShell requires MFA

Enabling Security Defaults