That said, it offers sensible options that suit most small teams. Security Defaults is all or nothing - there are no choices or configuration options. Legacy authentication is disabled because it doesn't support MFA. Users will be prompted for MFA 'when necessary' (this is not strictly defined by Microsoft but includes when users show up on a new device or app, and for critical roles and tasks).Īccess to Azure portal, Azure CLI or Azure PowerShell by anyone will always require MFA. Only authenticator-style apps are permitted as MFA methods - this is a secure method and one we would recommend anyway.Īdmins will always be prompted for MFA on login. Once enabled, Security Default makes following changes in your tenant:Īll users must register for MFA within 2 weeks from their next interactive login - no users can be exempt from requiring MFA. However, it's inflexible, with no configuration options, and must be applied to all accounts.

It's simple, quick and available to everyone regardless of license. Security Defaults enables MFA for everyone.

Azure ad multifactor authentication