Microsoft 365 FundamentalsDescribe security, compliance, privacy, and trust in Microsoft 365Medium
A Microsoft 365 administrator is configuring a new tenant and wants to ensure a baseline level of security for all users without requiring extensive configuration. The organization wants to enforce multi-factor authentication (MFA) for administrative roles, block legacy authentication, and require MFA for risky sign-ins. Which Microsoft 365 feature provides these security controls by default and is recommended for organizations with Azure AD Free or Microsoft 365 Business Basic/Standard licenses?
- AAzure AD Identity Protection
- BMicrosoft Defender for Identity
- CAzure AD Conditional Access policies
- DAzure AD Security Defaults
Show answer & explanationAnswer & explanation
Correct answer: D. Azure AD Security Defaults
Azure AD Security Defaults provide a basic level of security for all Azure AD tenants, especially those without Azure AD Premium licenses. They enforce MFA for administrators, block legacy authentication protocols, and require MFA for users performing risky activities, offering immediate protection without complex configuration.
Why the other options are wrong
- A. Identity Protection detects and remediates identity risks but doesn't provide these baseline security controls as a default enforcement mechanism for all users without Premium licenses.
- B. Defender for Identity protects against advanced threats affecting on-premises identities, not baseline cloud security defaults.
- C. Conditional Access policies offer granular control but require Azure AD Premium licenses and more configuration.
Azure AD Security Defaults
A set of pre-configured security policies in Azure Active Directory that provide a baseline level of security for all organizations. They enforce strong authentication methods, such as multi-factor authentication, and block legacy authentication protocols.
- Enabled by default for new tenants.
- Enforces MFA for all users, especially admins.
- Blocks legacy authentication protocols.
Memory trick: Security Defaults: The 'easy button' for essential Azure AD protection.