Azure AD Security Defaults Arrive (Oct 2019): Free Baseline Protection for Every Tenant

Retrospective: this article looks back at events from October 2019, written in 2026 with the benefit of hindsight.

In October 2019, Microsoft introduced Security Defaults for Azure Active Directory (now Entra ID). It replaced earlier "baseline policies" with a single switch that applied a set of preconfigured security settings to a tenant — free for everyone.

What Security Defaults does

• Requires all users to register for multi-factor authentication.
• Requires administrators to perform MFA at every sign-in.
• Requires users to perform MFA when necessary (for example, risky situations).
• Blocks legacy authentication protocols.
• Protects privileged activities such as access to the Azure portal.

Microsoft began enabling Security Defaults automatically for new tenants and later for many existing tenants that had no Conditional Access policies.

Why it mattered

Conditional Access required Azure AD Premium licenses. Many small businesses on Office 365 Business plans had no way to enforce MFA beyond per-user settings that were easy to misconfigure. Security Defaults gave every organization a baseline. Microsoft stated that MFA blocks the vast majority of account compromise attacks.

The trade-offs

Security Defaults is all-or-nothing: you cannot exclude specific users or apply different rules to different groups. Organizations with service accounts, specific location needs or more nuanced requirements must use Conditional Access instead — and Security Defaults must be turned off to use Conditional Access.

In hindsight

Security Defaults remains one of the most effective security features Microsoft has shipped, simply because it is on by default. A common assessment finding is a tenant where someone disabled it years ago "to fix a problem" and replaced it with nothing.