Security defaults are a free, on or off baseline that requires multifactor authentication and blocks legacy authentication. Conditional Access needs at least Microsoft Entra ID P1 and lets you tailor policy. Small organizations without premium licenses should use security defaults. If you have P1 or P2, Microsoft says defaults are probably not right for you.
What security defaults enforce
Microsoft lists these controls:
- All users must register for multifactor authentication.
- Administrators must do multifactor authentication.
- Users do multifactor authentication when necessary.
- Legacy authentication protocols are blocked.
- Device code flow is blocked.
- Privileged activities such as Azure portal access are protected.
Microsoft says new tenants get security defaults at creation, with a 24 hour grace period, and that from July 1, 2026 all new tenants block device code flow under security defaults. Microsoft also cites that multifactor authentication together with blocking legacy authentication stops the great majority of common identity attacks, though that is Microsoft's own analysis.
Who each fits
Security defaults suit organizations that do not know where to start or use the free licensing tier. Conditional Access suits organizations with P1 or P2 licenses or complex needs, such as different rules per group, location or app.
| Security defaults | Conditional Access | |
|---|---|---|
| License | None | At least P1 |
| Customization | On or off | Fully customizable |
| Complexity | Simple | Depends on your design |
Things to check before enabling defaults
- Make sure admins are not using legacy protocols. Defaults block Exchange ActiveSync basic authentication.
- Do not disable authentication methods in the MFA service settings, or you may lock yourself out.
- Devices and apps that depend on device code flow will stop signing in.
- Have two cloud only emergency access accounts, as Microsoft recommends.
- After enabling, revoke tokens so existing sessions go through registration.
Switching to Conditional Access
You must disable security defaults before Conditional Access policies can replace them. Microsoft advises enabling Conditional Access policies right away. Microsoft managed Conditional Access policies exist to keep the same protections: block legacy authentication, require MFA for Azure management, for admins and for all users. Then look at the secure foundations templates.
Use report only mode first so you can see impact before you enforce.
A decision rule
No P1 license and no custom needs: use security defaults and be done. P1 or higher: build Conditional Access, starting with the managed policies, plus emergency access accounts excluded with monitoring.
Quick check
Can I run security defaults and my own Conditional Access policies together?
No. Security defaults must be disabled before Conditional Access policies replace them.
Do security defaults need a paid license?
No. Microsoft lists the required license as none.
Sources
Last reviewed: 19 October 2026.
