Microsoft Entra Security Defaults get more flexible

Key insights

• Security Defaults is moving from one on/off switch to individual Microsoft-managed rules.
• The new MFA rule applies to all users in scope, including administrators.
• Security Defaults and Conditional Access can now run side by side.
• The change is in preview, with Microsoft sharing rollout details during the phased release.
• Nick Ross still recommends Conditional Access over Security Defaults.

Nick Ross [MVP] (T-Minus365) recently explained that Microsoft is changing Security Defaults in Microsoft Entra ID. His takeaway is simple: the old all-or-nothing switch is being replaced by a more flexible model, which matters for tenants still using Microsoft 365 Business Basic or Standard. That shift should make the baseline easier to manage, while still keeping Microsoft’s managed protections in place.

The video frames this as an update to a long-standing tradeoff. For years, one exception, such as a scanner, a service account, or a user who needed more time, could force admins to turn Security Defaults off completely. The new model aims to remove that pressure by letting admins work with individual controls and exclusions instead of abandoning the whole baseline.

What's new

According to the video and supporting notes, Microsoft is changing Security Defaults in Microsoft Entra ID from a single global setting into a set of Microsoft-managed rules. That means administrators can inspect each protection, see what it covers, and enable or disable it independently. The material describes this as four Microsoft-managed rules in the preview.

One of the clearest changes is the MFA rule. In the new model, it requires multifactor authentication for all users in scope, including administrators. The source material also says Microsoft is communicating changes to tenants during the phased rollout, including information about protections and possible device code flow enablement.

Why it matters

This update is most relevant to admins who have relied on Security Defaults as the free baseline for identity protection. The old model was useful, but inflexible: if one workload could not cope with the baseline, the only option was often to switch everything off. The new approach gives admins more room to keep protections in place while dealing with exceptions.

It also matters for smaller organizations that do not have Entra ID P1 or a dedicated identity team. The notes say Security Defaults remain a practical starting point for organizations without deep identity-management resources. For daily work, the main change is less about new user-facing features and more about clearer control over sign-in behavior, MFA prompts, and authentication risk.

Nick Ross also places the change in a licensing context. He says he still recommends Conditional Access over Security Defaults, and the material says the new setup can help as a bridge toward Conditional Access and Business Premium. That makes this update relevant not only to admins who use the baseline today, but also to teams planning their next step up the licensing ladder.

How it works

The material describes a move to a rule-based experience. Instead of treating Security Defaults as one on/off toggle, Microsoft is exposing individual protections so admins can review their scope and state. In practice, that should make it easier to understand what each control does before deciding whether to keep it enabled.

The video highlights three operational points in particular:

1. Administrators can manage protections individually instead of disabling the whole baseline for one exception.
2. MFA for all users now means more frequent sign-in prompts, but not every sign-in.
3. Security Defaults and Conditional Access can run side by side, and policies can stack.

The material also notes that Microsoft is presenting this as a phased preview for selected Microsoft Entra ID Free tenants. That means the experience is not described as a finished, universally available change in the source material. Nick Ross says his blog post will be updated as GA timelines are announced, which shows that the rollout is still moving.

Limitations and open questions

The source material does not give a full tenant-by-tenant rollout map, so we cannot verify exactly which organizations have the new model today. It also does not list every one of the four Microsoft-managed rules, only the fact that there are four in the preview.

There are still open questions around the final GA behavior. The material mentions that Microsoft is sharing rollout information and that changes may include device code flow enablement, but it does not spell out every policy interaction. The exact sign-in impact of stacked policies is also only described at a high level, not with a full technical matrix.

Nick Ross recommends Conditional Access over Security Defaults, but the source does not go into a full comparison of every control or licensing boundary. For readers deciding what to do next, the main message is that Security Defaults are becoming more usable, but they are still presented as a stepping stone rather than the destination.

Sources

• Nick Ross video on Security Defaults changes

Frequently asked questions

What is changing in Security Defaults?

Microsoft is moving from one all-or-nothing Security Defaults setting to individual Microsoft-managed rules. The material says admins will be able to review and control those protections separately.

Does the new model change MFA behavior?

Yes. The source says the new MFA rule applies to all users in scope, including administrators. It also says users may see more frequent prompts, but not every sign-in.

Can Security Defaults and Conditional Access be used together?

Yes. The video says they can run side by side and that policies can stack. The material does not provide a full behavior matrix for every combination.

Is this already fully rolled out?

No clear full rollout is given in the source. It is described as a phased private preview for selected Microsoft Entra ID Free tenants.