The settingWhat we hold this to
CreativeTechs minimum
Security Defaults = disabled AND at least one enabled CA policy enforcing MFA already in place. Never one without the other.
Benchmark position
Microsoft position: Security Defaults for tenants without P1, Conditional Access for those with it. Huntress rates 'Security Defaults are disabled' High.
Where we differ, and why
This is an ordering assertion, not a value. A tenant with Security Defaults off and no CA policy is WORSE than one with them on — the check must test both halves together or it will green-light a wide-open tenant.
Where the switch is
Entra admin centre → Identity → Overview → Properties → Manage security defaults.
How to verify
Graph: /policies/identitySecurityDefaultsEnforcementPolicy → isEnabled eq false AND /identity/conditionalAccess/policies → at least one state eq 'enabled' with builtInControls contains 'mfa'
- Why it matters
- Security Defaults and Conditional Access are mutually exclusive. A tenant on Security Defaults cannot run a single CA policy, so this gates most of the baseline — and a Business Standard tenant gets Security Defaults or nothing.
- How we check
- Huntress 'Security Defaults are disabled' (High). Maester MT.1021.
- Fix — M365
- Only after the CA MFA policy is built and validated in report-only. Turning Security Defaults off before CA is live leaves the tenant with no MFA whatsoever.
- Fix — Google
- No equivalent.
- User notices
- None if sequenced. Serious if reversed.
- Expected pushback
- None — a sequencing gate, not a policy. The one control where doing it in the wrong order is worse than not doing it.
- Reason on file
- Only tenants holding Entra ID P1 — a Business Standard tenant has Security Defaults or nothing.