What are Microsoft Security Defaults in Azure AD?
Security defaults are Microsoft settings that help protect your organization from identity-based attacks including phishing, hacking and intrusions. The security defaults protect your account by enforcing Multi-Factor Authentication (MFA) and provide all users with baseline protection.
What Should I Know About These Settings?
The security defaults disable applications that do not support modern Office 365 authentication by using legacy authentication protocols. For example, if security defaults are enabled, you need to use a modern authentication-enabled email client to sign in to your account.
Enabling security defaults also changes how you, as an admin, and your users log in to Office 365 services:
- Prevents less secure apps and legacy authentication from outdated email clients. It also restricts login access through IMAP, POP3, SMTP, or Remote PowerShell.
- Enforces Multi-Factor Authentication (MFA) for all users, requiring them to set up MFA during sign-in.
- Mandates MFA for privileged accounts in Azure Active Directory to access services such as Azure CLI and the Azure portal.
If you want to use Conditional Access policies (which allow you to customize security settings), you must first disable security defaults before applying those policies.
Enable or Disable Microsoft Security Defaults in Office 365
You can turn these security settings on/off at any time via the Microsoft Azure Portal. The sign-in to your Office 365 account will fail, despite previously having enabled MFA and App Password
In some cases, you may also see the following prompt when signing in to Office 365:
“Microsoft has enabled security defaults to keep your account secure.”
In such situations, disabling security defaults may be necessary. Keep in mind that only a global administrator can make these changes.
Steps to turn off Security Defaults in Office 365
- Step 1: Log in to Office 365 using global administrator credentials.
- Step 2: Click on 'Admin' (gear icon) from the left panel.
- Step 3: From the ‘Admin centers’ section, select ‘Azure Active Directory’ to proceed.
- Step 4: In the left-hand panel, open ‘Properties’.
- Step 5: Scroll down and select the ‘Manage Security defaults' option.
- Step 6: Adjust the toggle for Security defaults.
Set ‘Enable security defaults’ to ‘No’ and save your changes. (Switch it to ‘Yes’ if you want to turn the settings back on.)
Once the security defaults are disabled, users will no longer be prompted to configure MFA during sign-in.
Enable Access to Basic Authentication Protocols
If you are unable to connect your IMAP or POP accounts (such as Gmail, Hotmail, or Outlook) to your email clients, you may need to enable legacy authentication protocols. Follow the steps below to configure this setting:
- Step 1: Login to Office 365 using global administrator credentials.
- Step 2: From the left panel, click on Admin (gear icon).
- Step 3: Open the navigation menu in the top-left corner, select ‘Show All’, expand ‘Settings’, and then click on ‘Org Settings’.
- Step 4: In the ‘Modern authentication’ section, choose the protocols you want to enable and then click ‘Save’ to apply the changes.
Now, your email clients will be able to access your account or connect using IMAP.
When migrating from Office 365 to Office 365, the EdbMails Office 365 Migration enables you to migrate the email, mail items, contacts, folders, etc. from one Office 365 tenant to another without using manual solutions like PowerShell. In addition, the tool allows modern and safe authentication of Office 365 through OAuth 2.0. Download and install the latest version and enjoy this facility. You do not need to disable the security defaults of the Office 365 any more if you turn on the modern authentication.
