https://www.sikich.com

Office 365: Introducing Security Defaults

Jerad Cook

Apr 27 2020

3 min read

In a recent blog post from a member of Microsoft’s Security and Protection Team, an announcement was made in regards to the way that Microsoft is planning to handle security settings, in the form of a new feature called Security Defaults.

Before diving into what the new Security Defaults feature will offer, here is a recap of how security has improved across tenants between 2014 and 2019. The most revealing detail of the recap is that data shows that more than 99.9% of organization account compromises could be stopped by using Multifactor Authentication (MFA). This is a feature that is included in all Office 365 business and enterprise licenses, which means you are most likely already paying for it!

Microsoft is aware of the fact that there are millions of organizations accounts vulnerable to preventable compromises. This is where the new Security Defaults feature comes in, which, when enabled, will require MFA for all user and admin accounts. Currently, this can be done with a preview feature, Baseline Policies, and the Security Defaults feature will replace that as of February 29, 2020. To further push the use of MFA, the Security Defaults feature will be enabled on all new tenants going forward, as well as those created on or after October 22, 2019.

On top of enforcing MFA, Security Defaults provides the additional protection of disabling legacy authentication clients. One reason for this is that legacy clients do not support MFA. The other being that legacy authentication protocols are slated to be retired from support by Microsoft at the end of this year. Additional settings will be enabled by default via this feature in the future, but for now, they are starting with these changes that will vastly increase security. If you’re interested in what other simple setting changes you can manually make to add further protection, see my previous blog posts that expand on this.

Microsoft has made it clear that their intent for enabling these settings by default is to target their less savvy users who may not know how to configure MFA manually. For those who are using advanced features like Conditional Access policies to handle tasks like manage a break glass account for emergency access, or enforce MFA based on device compliance, they recommend disabling Security Defaults and continuing to manage MFA manually. In fact, the Security Defaults feature will not be able to be enabled if a Conditional Access policy is in place.

Sikich recommends the use of MFA, so this new feature is a welcomed change. It is a responsible move by Microsoft, who continues to show that they take cloud security very seriously. If you aren’t currently using multifactor authentication and want to roll it out in a smooth, controlled fashion, please reach out to Sikich to discuss how we can help with the process!

This publication contains general information only and Sikich is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or any other professional advice or services. This publication is not a substitute for such professional advice or services, nor should you use it as a basis for any decision, action or omission that may affect you or your business. Before making any decision, taking any action or omitting an action that may affect you or your business, you should consult a qualified professional advisor. In addition, this publication may contain certain content generated by an artificial intelligence (AI) language model. You acknowledge that Sikich shall not be responsible for any loss sustained by you or any person who relies on this publication.

About the Author

Jerad Cook

Jerad Cook is a Senior Network Consultant at Sikich, assisting clients in achieving their business objectives through technology and trusted advice. He holds a Bachelor’s degree in Computer Information Systems from Kent State University, as well as several Microsoft certifications that give him a Microsoft Certified Solutions Expert (MCSE) status. His primary area of focus revolves around Microsoft’s Cloud services, which he has ten years of experience with. This includes working with both Azure and Office 365 environments in order to drive clients toward full cloud enablement.