Security Defaults Is No Longer All or Nothing: What the New Preview Means for MSPs

If you manage customers on Microsoft 365 Business Basic or Business Standard, Security Defaults has probably been your MFA strategy for years. It was free, it blocked legacy authentication, and it came with one painful catch: a single switch. One app that couldn't cope meant turning the whole baseline off.

Microsoft is changing that. The updated Security Defaults breaks the baseline into individually managed protections, tightens how MFA is enforced, and finally lets Security Defaults coexist with Conditional Access. For smaller tenants that need real protection without extra licensing, this is a meaningful shift.

Four protections you can now manage one at a time#

The old model was binary: Security Defaults on, or Security Defaults off. The new model lets administrators manage four protections independently:

1. Administrator MFA
2. User MFA
3. Legacy authentication blocking
4. Device code flow blocking

You can adjust one of them without giving up the rest of the baseline.

Exceptions no longer cost you the whole baseline#

This is the part we expect MSPs to feel first. Until now, when a specific application or authentication requirement broke under Security Defaults, the only fix was disabling Security Defaults entirely. Now you can manage the individual protection causing the problem and leave everything else enforced.

Microsoft is also moving Security Defaults toward a Microsoft-managed policy model, similar to Conditional Access. In that model, administrators control policy states and may be able to manage exclusions without modifying the underlying security requirements.

Registered for MFA is not the same as MFA enforced#

Under the old Security Defaults, users had to register for MFA, but Microsoft decided when to actually challenge them, based on signals like location, device, and activity.

The new rule requires MFA for every sign-in within its scope.

That does not mean users get prompted every time they open an application. An existing valid MFA session, or a method like Windows Hello for Business, can satisfy the requirement. The point is the distinction itself: a user who is registered for MFA is not necessarily a user who has MFA enforced, and the updated Security Defaults closes that gap.

Can Security Defaults and Conditional Access run together now?#

Yes. Previously you had to pick one. With the updated experience, Security Defaults provides the foundational protections while Conditional Access adds the advanced controls, such as device compliance requirements, location restrictions, and granular exclusions.

Two caveats worth keeping in front of you:

• Licensing still applies. Custom Conditional Access policies require the appropriate Entra ID licensing (P1 or P2).
• Policies stack. If you run Security Defaults and Conditional Access in parallel, every policy in scope has to be satisfied. An exclusion in one place does not override a requirement in another.

Who can use it, and when?#

As of October 15, 2026, the new Security Defaults experience is an invite-only preview for selected Microsoft Entra ID Free tenants. Microsoft has not announced general availability timelines.

What MSPs should take from this#

For small businesses, this is a welcome change: stronger identity security without the complexity or cost of additional licensing, and far fewer reasons to switch the baseline off entirely.

It also adds new things to track. Four separately managed protections means four settings that can each be on, off, or quietly changed in every customer tenant.

At CloudCapsule, we plan to expand our security assessments to evaluate these individual protections as Microsoft makes the necessary information available through supported APIs. That will help MSPs see which protections are enabled, spot missing controls, and catch configuration changes across customer tenants. Today, we already evaluate MFA enforcement across Conditional Access policies, Security Defaults, and legacy per-user MFA settings to give you a true gap analysis on MFA in each organization.

For the full details, see Microsoft's documentation on managing individual Security Defaults protections (preview) (opens in new tab).