What this check looks at
Verifies the tenant has at least one identity baseline in force: security defaults enabled, or a working set of Conditional Access policies.
Every Microsoft 365 tenant needs an identity baseline: at the least MFA for everyone and legacy authentication blocked. Entra ID offers it in two ways. Security defaults are a free, all-or-nothing switch that makes everyone register Microsoft Authenticator, asks for MFA when Microsoft judges it necessary, always asks administrators, and blocks legacy authentication. Conditional Access, which needs Microsoft Entra ID P1, replaces them with policies you control. The two cannot run together.
The check fails when security defaults are off and no Conditional Access policy is enabled: the tenant then has no identity baseline at all. It warns when security defaults are on but the tenant holds Entra ID P1 and has no enabled Conditional Access policy, because the finer-grained controls being paid for are unused. It passes when security defaults are on without P1, or when at least one Conditional Access policy is enabled.
A tenant with neither usually got there by accident: security defaults were switched off to make a scanner or an old app work, or during a migration, and nothing replaced them. From then on every account, Global Administrators included, signs in with a password alone, from anywhere, over any protocol.
Why it matters
A tenant with security defaults switched off and no Conditional Access policies has no identity controls at all — every account is protected by its password alone.
With no baseline, the first phished or guessed password is a full compromise. For an administrator that means the attacker can create their own admin accounts, read every mailbox, change mail flow and delete data held in the tenant. Recovering a small business from that takes days of specialist work, and trust in the tenant has to be rebuilt account by account.
Insurers and auditors treat the absence of MFA as a basic failure: a claim can be contested where the proposal form said MFA was in place. A personal data breach reached through an unprotected account is the kind the ICO expects to be reported, and the absence of basic controls weighs against the organisation.
Cyber Essentials requires MFA on cloud services for all users and administrators, which a tenant with neither baseline cannot provide. Microsoft recommends security defaults for any tenant without Entra ID P1, the CIS Microsoft 365 Foundations Benchmark builds its identity section on Conditional Access policies, and the NCSC 10 Steps place identity and access management at the core of an organisation’s defences.
How to fix it
Where: Entra admin centre → Identity → Overview → Properties
Before you start
- Check the licences: tenants with Entra ID P1 (Business Premium, E3, E5) should use Conditional Access; others should use security defaults.
- Security defaults and Conditional Access cannot run together; plan the switch in one change window.
- Confirm two emergency access (break-glass) accounts exist and exclude them from the policy, so a mistake cannot lock every administrator out.
Step by step
- Check the licences. In the Microsoft 365 admin centre, go to Billing > Your products and look for Microsoft 365 Business Premium, E3 or E5, or a Microsoft Entra ID P1 or P2 subscription. Without P1, use security defaults (next step). With P1, build a Conditional Access baseline (the steps after).
- Without Entra ID P1: turn on security defaults. First check the sign-in logs (Entra ID > Monitoring & health > Sign-in logs, Client app filter on Legacy Authentication Clients) for scanners or old apps that will stop working. Then go to Entra ID > Overview > Properties, select Manage security defaults, set Security defaults to Enabled and save. People are asked to register Microsoft Authenticator at sign-in, with 14 days before it becomes compulsory. Then go to the last step.
- With Entra ID P1: prepare the emergency access accounts. Confirm two emergency access accounts exist: cloud-only, on the .onmicrosoft.com domain, Global Administrator, with strong credentials stored securely. Put them in a group used only to exclude them from Conditional Access.
- Create the baseline policies in report-only mode. Go to Entra ID > Conditional Access > Policies > New policy (or Create new policy from templates) and create four policies, each excluding the emergency access group and set to Report-only: administrator directory roles, All resources, Grant: Require multifactor authentication; All users, All resources, Conditions > Client apps: Exchange ActiveSync clients and Other clients, Grant: Block access; All users, All resources, Grant: Require multifactor authentication; All users, target resource Windows Azure Service Management API, Grant: Require multifactor authentication.
- Review the report-only results. After a few days, open a sample of sign-ins in Entra ID > Monitoring & health > Sign-in logs and check each policy’s result on the Report-only tab. Register anyone who could not do MFA and move any legacy clients before going further.
- Switch over in one sitting. If security defaults are on, go to Entra ID > Overview > Properties > Manage security defaults, set them to Disabled and give the reason that the organisation is using Conditional Access. Straight away, set each baseline policy to On. Do both in the same session so the tenant is never without protection.
- Confirm the baseline. Check that Manage security defaults shows the setting you chose, or that the baseline policies show On in the Conditional Access policy list. Sign in as a test user in a private browser window and confirm you are asked for MFA, then re-run the assessment.
What users will notice
Users are asked to register and use MFA. With security defaults, legacy authentication is blocked for everyone at once.
How to confirm it worked
In Entra ID, Overview, Properties, Manage security defaults, confirm the setting you chose; or confirm the Conditional Access baseline policies are On.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | User access control |
| Cyber Essentials Plus | Multi-factor authentication test on cloud servicesUser access control |
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(d) Strong authentication mechanisms |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 8.3.1 All user access is authenticated |
| NIST SP 800-171 | 3.5.2 Authenticate users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.2 Authentication |
| ISO 27001:2022 | A.8.5 Secure authenticationA.8.9 Configuration management |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1) |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Security defaults (Microsoft Learn)