Microsoft 365 Security Defaults vs Conditional Access: Which Should Australian SMBs Choose?

For Australian SMBs setting up Microsoft 365 identity security, the choice between Security Defaults and Conditional Access is the most consequential configuration decision you will make — and getting it wrong leaves accounts unprotected or legitimate users locked out.

The direct answer: Security Defaults is the right starting point for organisations with no existing MFA enforcement. Conditional Access is the right long-term solution for any organisation with a Microsoft 365 Business Premium licence. If you already have Business Premium, you should migrate to Conditional Access.

This guide explains what each option does, the trade-offs, the licence requirements, and the step-by-step path to migrate safely.

Not sure which option your tenant is currently using? Our Microsoft 365 Health Check will tell you exactly what is and is not configured, alongside your Microsoft Secure Score and a prioritised remediation plan.

What are Security Defaults?

Security Defaults are a set of pre-configured identity security settings that Microsoft enables with a single toggle in the Microsoft Entra admin centre. They were introduced in 2019 to replace the older "baseline policies" and are enabled by default on all new Microsoft 365 tenants created after October 2019.

When Security Defaults are enabled, Microsoft enforces:

• MFA for all users — Every user must register for Microsoft Authenticator MFA. Users are prompted at sign-in and have 14 days to register before MFA is enforced.
• MFA for administrators — Admin accounts are always prompted for MFA on every sign-in, with no grace period.
• Block legacy authentication — Protocols that do not support modern MFA — including SMTP AUTH, IMAP, POP3, and older Office clients using basic authentication — are blocked for all users.
• Protect privileged actions — Actions in the Azure portal, Microsoft Entra admin centre, and Microsoft Intune always require MFA, even if the user has already authenticated.

Security Defaults are free. No additional licence is required beyond any Microsoft 365 plan.

What Security Defaults cannot do

Security Defaults apply uniformly to every account in your tenant. There is no ability to:

• Exclude specific users (other than accounts that Microsoft automatically excludes, such as service accounts using legacy protocols with app passwords)
• Create named location rules (for example, no MFA when connecting from the office network)
• Apply different policies based on device compliance state
• Enforce different authentication strength requirements for high-risk users
• Integrate sign-in risk signals from Microsoft Entra ID Protection

What is Conditional Access?

Conditional Access is Microsoft's policy engine for identity-based access control. Instead of a single uniform rule applied to all users, Conditional Access lets you define policies with conditions and access controls:

• Who — Specific users, groups, roles, or all users
• What — Specific applications, all cloud apps, or user actions
• Where — Named locations (IP ranges or countries), compliant devices, domain-joined devices
• When — Sign-in risk level (low, medium, high) or user risk level from Entra ID Protection
• How — Grant access requiring MFA, compliant device, approved app, or terms of use; or block access entirely

A typical Conditional Access policy for an Australian SMB might read: "Require MFA for all users accessing all cloud apps, except when the device is Intune-enrolled and compliant and the sign-in is from Australia."

Licence requirement

Conditional Access requires Microsoft Entra ID P1. This is included in:

• Microsoft 365 Business Premium
• Microsoft 365 E3 and E5
• Microsoft 365 F3
• Microsoft Enterprise Mobility + Security E3 and E5

It is not included in Microsoft 365 Business Basic or Business Standard. If you are on these plans and want Conditional Access, either add Entra ID P1 as an add-on or upgrade to Business Premium — which also adds Microsoft Defender for Business, Microsoft Intune, and Azure Information Protection, making it the most cost-effective identity and device security option for Australian SMBs under 300 users.

Side-by-side comparison

Which should Australian SMBs choose?

Use Security Defaults if:

• You are on Microsoft 365 Business Basic or Standard without the budget to upgrade
• Your organisation has no existing MFA enforcement and you need immediate protection
• You have fewer than 10 users and no complex access scenarios
• You are in a short-term remediation phase before migrating to Conditional Access

Use Conditional Access if:

• You have Microsoft 365 Business Premium (Entra ID P1 is already included in your licence — use it)
• You need to exclude break-glass administrator accounts from MFA policies
• You have remote workers, partner access, or branch office scenarios requiring named location rules
• You need device compliance conditions as part of your ACSC Essential Eight Maturity Level 2 implementation
• You have applications that require different authentication strength requirements
• You are subject to Australian government cybersecurity frameworks including the PSPF or ISM

The ACSC Essential Eight guidance is clear: Maturity Level 2 requires MFA enforced for all users, with controls that prevent users from bypassing MFA. Conditional Access policies with enforcement mode "Grant access — require MFA" satisfy this requirement in a way that is auditable and configurable. Security Defaults meets the spirit of Maturity Level 1 but lacks the granular evidence collection needed for a formal Essential Eight assessment.

For a comprehensive view of where your current Microsoft 365 configuration sits against the Essential Eight and other Australian security benchmarks, read our pillar guide to Microsoft Secure Score for Australian SMBs.

How to migrate from Security Defaults to Conditional Access

This is the path that matters for most Australian SMBs on Business Premium. Follow these steps carefully — there is a brief window between disabling Security Defaults and enabling Conditional Access policies where MFA is not enforced.

Step 1 — Audit your current MFA registration status

Before changing anything, confirm how many users have already registered for MFA.

1. Sign in to entra.microsoft.com.
2. Navigate to Identity > Monitoring and health > Usage and insights.
3. Select Authentication methods activity.
4. Review the Registration tab to see which users have completed MFA registration.

If more than a small number of users have not registered, do not proceed yet. Run an MFA registration campaign first so users are not caught off-guard when Conditional Access enforces registration.

Step 2 — Create your Conditional Access policies before disabling Security Defaults

This is the most critical step. Build your policies in Report-only mode before touching Security Defaults.

1. Navigate to Protection > Conditional Access in the Entra admin centre.
2. Select New policy.
3. Name it clearly: for example, "Require MFA — All users — All apps."
4. Under Assignments > Users, select "All users" then under Exclude, add your break-glass administrator account group.
5. Under Target resources, select "All cloud apps."
6. Under Access controls > Grant, select "Grant access" and check "Require multi-factor authentication."
7. Set Enable policy to Report-only (not On).
8. Save the policy.

Create a second policy to block legacy authentication:

1. Name it "Block legacy authentication."
2. Users: All users.
3. Target resources: All cloud apps.
4. Under Conditions > Client apps, select "Exchange ActiveSync clients" and "Other clients."
5. Under Access controls > Grant, select "Block access."
6. Set to Report-only and save.

Step 3 — Monitor Report-only mode for 5 to 7 days

With policies in Report-only mode, Microsoft logs what would have happened if the policies were active — without actually enforcing them. Review the Sign-in logs in Entra to confirm:

• The MFA policy would have triggered for the expected users.
• The legacy auth block would not have affected any critical business applications.
• Break-glass accounts appear correctly in the exclusion report.

Step 4 — Enable Conditional Access policies and disable Security Defaults simultaneously

When you are satisfied with the Report-only results:

1. Navigate to each Conditional Access policy and change Enable policy from Report-only to On. Save.
2. Immediately navigate to Identity > Overview > Properties in the Entra admin centre.
3. Select Manage security defaults.
4. Toggle Security defaults to Disabled and select a reason.
5. Save.

The window between Step 1 and Step 5 above should be under two minutes. Complete both actions in quick succession.

Step 5 — Verify sign-in behaviour

After enabling:

1. Test sign-in with a standard user account in a private browser window.
2. Confirm MFA is prompted.
3. Test a legacy authentication connection if you have devices using SMTP AUTH or similar — confirm the connection is blocked as expected.
4. Check the Entra Sign-in logs after 15 minutes to confirm policies are applying.

Break-glass accounts — a critical consideration for Australian organisations

A break-glass account is an emergency administrator account that bypasses normal access controls and is used only when all other admin access methods are unavailable — for example, after an MFA outage or a misconfigured Conditional Access policy locks out all administrators.

Security Defaults does not support break-glass account exclusions. If your Authenticator app is unavailable and Security Defaults is enforcing MFA, you can be locked out of your own tenant.

Conditional Access solves this. Create a dedicated break-glass account group, exclude it from all Conditional Access policies, and protect the account with a strong physical credential (a 30-character random password stored in a physical safe). Monitor this account with an alert that triggers on any sign-in.

Australian government agencies and organisations subject to the PSPF are required to document break-glass procedures. Even for private sector Australian SMBs, having a tested break-glass process is a basic operational resilience requirement.

What about Microsoft Entra ID Protection risk-based policies?

Entra ID Protection analyses each sign-in for risk signals — impossible travel, atypical location, leaked credentials, malicious IP addresses — and assigns a risk level of Low, Medium, or High.

Risk-based Conditional Access policies require Microsoft Entra ID P2 (included in Microsoft 365 E5 and Microsoft 365 Business Premium does not include P2). If you have P2 licences, add two additional policies:

• User risk policy — If user risk is High, require the user to change their password.
• Sign-in risk policy — If sign-in risk is Medium or High, require MFA.

These policies are the closest alignment to ACSC Essential Eight Maturity Level 3, where authentication must respond to real-time risk signals.

Making your decision

The right choice for most Australian SMBs is straightforward:

• On Business Premium? Migrate to Conditional Access this quarter. The licence is already paid for.
• On Business Basic or Standard with no upgrade budget? Enable Security Defaults now if not already enabled. It is far better than no MFA enforcement.
• Preparing for an Essential Eight assessment or cyber insurance renewal? Conditional Access with documented policies and sign-in logs is far stronger evidence than Security Defaults.

If you are unsure which mode your tenant is currently in or whether your Conditional Access policies are correctly configured, our Microsoft 365 Health Check provides a same-day review of your identity configuration alongside your full Microsoft 365 security posture.