EIDTNT-007: Security Defaults Enabled/Disabled Status
- Platform
- Entra ID / M365
- Category
- Entra ID Tenant Configuration
- Severity
- Critical
- Zero Trust pillar
- Governance (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Security defaults provide a baseline set of identity security mechanisms including MFA registration requirements, MFA challenges for administrators, and blocking legacy authentication. Organizations using Conditional Access policies should have security defaults disabled to avoid conflicts, but tenants without Conditional Access that also have security defaults disabled have no baseline protection against common identity attacks. This check verifies that either security defaults or equivalent Conditional Access policies are actively protecting the tenant.
Recommended value
Security defaults enabled for tenants without Conditional Access. For tenants with Conditional Access, security defaults disabled with equivalent or stronger CA policies in place
Remediation
Check whether security defaults are enabled in Entra ID > Properties > Manage security defaults. If security defaults are disabled, verify that Conditional Access policies provide equivalent or stronger protection including MFA for all users, legacy authentication blocking, and MFA for administrative actions. If neither security defaults nor equivalent Conditional Access policies are in place, enable security defaults immediately as a baseline protection measure.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- IA-2, AC-2
- CIS M365 Benchmark
- 1.1.1
- MITRE ATT&CK
- T1078