Check ID: entra_security_defaults_enabled
Provider: Azure
Service: entra
Severity: CRITICAL
Categories: identity-access, e3
Resource type: NotDefined

​
What this check verifies

Microsoft Entra Security defaults provide tenant-wide baseline identity protections:
  • MFA registration and challenges
  • Legacy auth (IMAP/POP/SMTP) blocked
  • Extra checks for privileged access
This evaluation identifies whether that baseline is enabled at the tenant level.

​
Risk

Absent these defaults, users can sign in with password-only or via legacy protocols that bypass MFA, enabling password spray, replay, and phishing-based takeovers. Compromise risks data exposure (confidentiality), unauthorized changes (integrity), and service disruption (availability).

​
Recommendation

Activate Security defaults or implement equivalent Conditional Access as defense in depth:
  • Require MFA for all identities
  • Block legacy authentication
  • Safeguard admin portals and APIs Apply least privilege and zero trust, and regularly review access patterns and break-glass exceptions to keep coverage complete.

​
Remediation

az rest --method PATCH --url https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy --body '{"isEnabled":true}'

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_security_defaults_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks