What are Microsoft Security defaults in Azure AD?
Security defaults are Microsoft settings that help protect your organization from identity-related attacks such as phishing, hacking, and unauthorized access to your account. By default, these settings protect your account from potential threats by using Multi Factor Authentication (MFA) and provide a basic level of security for all users.
What should I know about these settings?
These Security settings prevent applications from using legacy authentication that do not support modern Office 365 authentication. For instance, in order to login to your email account with the security default enabled, you must use an email client that supports modern authentication.
Enabling the Security defaults also changes how you (admin) or your users will login to Office 365 and its services as outlined in the following points.
- Prevents less secure apps from logging into your account and also prevents legacy authentication from outdated email clients. It also restricts login access if you want to login via IMAP, POP3, SMTP, or Remote PowerShell.
- Enables Multi Factor Authentication (MFA) for all users, prompting them to configure MFA during sign-in.
- Enforces MFA for privileged accounts in the Azure Active Directory to access Azure CLI, Azure Portal and so on.
Furthermore, if you intend to use Conditional Access policies (where you can customize the security settings), you must first disable the security defaults before configuring the Conditional Access policies.
Enable or disable Microsoft security defaults in Office 365
You can enable or disable the security settings at any time through Microsoft's Azure portal. Authentication to your Office 365 account may fail even if you have enabled MFA and App Password.
You may also get the following prompt on your Office 365 login page ‘Microsoft has enabled security defaults to keep your account secure’
In all of the aforementioned cases, it is necessary to disable security defaults. Keep in mind that changing these settings requires you to login to your tenant as a global administrator.
Here are the steps to turn off Security defaults in Office 365 :
- Step 1: Login to Office 365 using global administrator credentials.
- Step 2: Click on 'Admin' (gear icon) from the left panel
- Step 3: Click on 'Azure Active Directory' under Admin centers
- Step 4: Click on 'Properties' from the left panel
- Step 5: Click on the 'Manage Security defaults' link
- Step 6: Toggle the Security default settings
Change the 'Enable security defaults' option to 'No' and save the changes. (Toggle it to 'Yes' if you want to enable the settings.)
After disabling the security settings, you will no longer be prompted with the MFA configuration during sign-in.
Enable access to basic authentication protocols
If you're having trouble connecting to your IMAP / POP accounts (Gmail, Hotmail, Outlook) from your email clients, make sure you've enabled access to legacy authentication protocols. Here's how to do it step by step.
- Step 1: Login to Office 365 using global administrator credentials.
- Step 2: Click on 'Admin' (gear icon) from the left panel
- Step 3: Click on the Navigation menu on the top left, click 'Show All', expand 'Settings' and click on 'Org Settings'.
- Step 4: Under Modern authentication, select all the protocols you would like to enable and click 'Save'.
Now, you will be able to allow your email clients to access your account or connect using IMAP.
If you want to migrate from Office 365 tenant to tenant, EdbMails Office 365 migrator can help you transfer all your emails, contacts, mail items, folders without requiring manual methods such as PowerShell scripts. Furthermore, EdbMails supports secure OAuth 2.0 based modern authentication for Office 365. Download and install the latest version to use this feature. Turning off security defaults in Office 365 are not required with the modern authentication feature.
