Security defaults vs Conditional Access: how they differ

Microsoft Entra ID offers two ways to require multifactor authentication (MFA) and block weaker sign-in methods across a Microsoft 365 tenant: security defaults and Conditional Access. Microsoft Entra ID, the identity service behind Microsoft 365, is where both are set. Microsoft presents them as alternatives rather than settings that run together. This page explains what each does according to Microsoft’s documentation, and how Microsoft describes the licences and the move from one to the other.

What security defaults do

Security defaults are a fixed set of protections. Microsoft’s documentation lists six basic controls:

• requiring all users to register for MFA
• requiring administrators to do MFA
• requiring users to do MFA when necessary
• blocking legacy authentication protocols, the older protocols that can’t do MFA
• blocking device code flow, a sign-in method some devices and apps rely on
• protecting privileged activities, such as access to the Azure portal.

Microsoft states that users register using notifications in the Microsoft Authenticator app (registration is by the notification option only), and can also use verification codes from Authenticator or from other apps that generate OATH TOTP codes.

Security defaults cost nothing extra. Microsoft says tenants created on or after 22 October 2019 might have security defaults enabled, and that it periodically notifies existing customers about automatic enablement of security defaults if they have no Conditional Access policies, no premium licences and aren’t actively using legacy authentication clients. Microsoft also notes that starting 1 July 2026, all new Microsoft Entra tenants block device code flow as part of security defaults.

Microsoft’s documentation describes security defaults as a set that is enabled or disabled, rather than a set of individual policies. The only exclusion it names is the Directory Synchronization Accounts role.

What Conditional Access does

Conditional Access policies are rules of the form “when these users access these resources under these conditions, require this”. Examples described in Microsoft’s documentation include:

• requiring MFA for users
• requiring an authentication strength, such as Microsoft’s built-in “Phishing-resistant MFA strength”, for selected users
• blocking legacy authentication (Microsoft’s example policy is created under Entra ID > Conditional Access > Policies in the Microsoft Entra admin center)
• requiring a device to be marked as compliant (with Microsoft Intune) to reach email and other resources. How Intune compliance policies work with Conditional Access covers this in more detail.

Microsoft’s licensing documentation states that Conditional Access requires Microsoft Entra ID P1 licences, and that Microsoft 365 Business Premium customers also have access to Conditional Access features. Risk-based Conditional Access requires Microsoft Entra ID Protection, which Microsoft lists as a P2 feature.

Side by side

Who Microsoft describes each option as suiting

Microsoft’s security defaults documentation describes them as suiting:

• organisations that want to increase their security posture but don’t know how or where to start
• organisations using the free tier of Microsoft Entra ID licensing.

The same page states that organisations with Microsoft Entra ID P1 or P2 licences may find security defaults are “probably not right” for them, and points organisations with complex security requirements to Conditional Access.

Which licences a tenant has is shown under billing and licences in the Microsoft 365 admin center. Microsoft’s licensing page links to its comparison of Entra ID features. The Microsoft 365 licensing and security features reference sets out which plans include which security features.

Moving from security defaults to Conditional Access

Microsoft states that organisations implementing Conditional Access policies that replace security defaults must disable security defaults. Microsoft’s documentation describes these steps:

1. Emergency access accounts. Microsoft’s emergency access documentation describes two or more cloud-only emergency access accounts with the Global Administrator role, protected by a passkey (FIDO2) or certificate-based authentication. How Microsoft describes emergency access accounts covers these in more detail.
2. Policies in report-only mode. Microsoft’s example policy for blocking legacy authentication starts in report-only mode so administrators can see its impact on users before switching it on.
3. Microsoft-managed policies. Microsoft’s security defaults page notes that Microsoft-managed Conditional Access policies are available to maintain the same protections: blocking legacy authentication, requiring MFA for Azure management, requiring MFA for admins and requiring MFA for all users.
4. Disabling security defaults. Based on Microsoft’s instructions (checked October 2026): sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator, go to Entra ID > Overview > Properties, select Manage security defaults, set Security defaults to Disabled (not recommended) and select Save. Microsoft’s page says that after administrators disable security defaults, organisations “should immediately enable Conditional Access policies to protect their organization.” Menus can change; Microsoft’s security defaults page has the latest steps.
5. Excluding and monitoring emergency accounts. Microsoft’s emergency access documentation describes excluding these accounts from any Conditional Access policy that blocks or restricts sign-in, and configuring alerts for every use of them.

A note on admin portals

Separately from both options, Microsoft’s mandatory MFA documentation states that MFA is required to sign in to the Azure portal, the Microsoft Entra admin center, the Microsoft Intune admin center and, from February 2025, the Microsoft 365 admin center. Microsoft says break-glass or emergency access accounts are also required to sign in with MFA once enforcement begins, and that a passkey (FIDO2) or certificate-based authentication satisfies the requirement.

Common questions

What’s the difference between security defaults and Conditional Access?

Security defaults are a fixed set of protections that Microsoft describes as enabled or disabled as a set, at no extra cost. Conditional Access uses individual policies for chosen users, resources and conditions, and requires Microsoft Entra ID P1. Microsoft lists six controls in security defaults, including MFA registration for all users and blocking legacy authentication. The side-by-side table compares them point by point.

Should I use security defaults or Conditional Access?

Microsoft describes security defaults as suiting organisations that want to improve security but don’t know where to start, and those on the free tier of Microsoft Entra ID. The same page says organisations with Entra ID P1 or P2 licences may find security defaults are “probably not right” for them, and points complex requirements to Conditional Access. Who Microsoft describes each option as suiting has the detail.

Can I use security defaults and Conditional Access together?

Microsoft presents them as alternatives rather than settings that run together. It states that organisations implementing Conditional Access policies to replace security defaults must disable security defaults, and says that after disabling them, organisations “should immediately enable Conditional Access policies to protect their organization.” Moving from security defaults to Conditional Access sets out the steps Microsoft describes.

Does Microsoft 365 Business Premium include Conditional Access?

Yes, according to Microsoft’s licensing documentation. It states that Conditional Access requires Microsoft Entra ID P1, and that Microsoft 365 Business Premium customers also have access to Conditional Access features. Risk-based Conditional Access needs Microsoft Entra ID Protection, which Microsoft lists as a P2 feature. The licensing and security features reference sets out which plans include what.

Can I exclude an account from security defaults?

Not in the way Conditional Access allows. Microsoft’s documentation describes security defaults as a set that’s enabled or disabled, and the only exclusion it names is the Directory Synchronization Accounts role. Excluding chosen accounts, such as emergency access accounts, is described for Conditional Access policies. What security defaults do covers the full set.

How do I turn off security defaults in Microsoft 365?

Microsoft’s steps: sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator, go to Entra ID > Overview > Properties, select Manage security defaults, set it to Disabled (not recommended) and select Save. Microsoft’s documentation describes emergency access accounts and Conditional Access policies being ready first. Step 4 of moving from security defaults to Conditional Access has the context.

Related guides

• Microsoft 365 MFA methods compared explains which methods Microsoft describes as phishing-resistant.
• The Microsoft 365 security baseline places this topic among the other settings Microsoft’s guidance covers.