Update to security defaults – Microsoft Community Hub

As part of Safe Future InitiativeWe have evolved our security approach around three security principles: security by design, security by default, and security by operation. Secured by default This means that security protections are enabled and applied by default. Security defaults in Microsoft Entra are an example of security by default approach. Security defaults are enabled for all new tenants. This provides a basic level of protection for Entra identities and resources. To ensure that organizations using security defaults are properly protected, we are updating the requirements for authentication methods to help improve your security posture.

We are removing the option to skip multi-factor authentication (MFA) enrollment for 14 days when security defaults are enabled. This means that all users must register for MFA the first time they log in after security defaults are set. MFA can block over 99.2% of identity-based attacks, helping reduce the risk of account compromise for 14 days. This change will affect newly created tenants starting December 2, 2024, and existing tenants starting January 2025.

This update is part of our ongoing efforts to provide secure and reliable ID services. If you don’t use Conditional Access, we recommend that you enable security defaults for your organization. Because security defaults provide a simple and effective way to protect users and resources from common threats.

To learn more about these upcoming updates and how you can best prepare for them, please review: documentation.

Nitika Gupta

Group Product Manager, Identity

Learn more about Microsoft Entra

Prevent identity attacks, ensure least-privileged access, unify access control, and improve user experience with comprehensive identity and network access solutions across on-premises and cloud.