Microsoft 365 Security Defaults vs Conditional Access: What Is the Difference?

Security Defaults is Microsoft's baseline security configuration, introduced in 2019 as a response to the fact that most Microsoft 365 tenants were being breached through basic attacks that MFA would have prevented.

When you enable Security Defaults, Microsoft applies a fixed set of policies to your entire tenant: MFA is required for all users, MFA is required for all administrators at every sign-in, legacy authentication protocols are blocked, and access to the Azure portal requires MFA.

Security Defaults is free, requires no licence beyond a basic Microsoft 365 plan, and takes about two minutes to enable. It is meaningfully better than nothing.

The limitation is that it is all-or-nothing. You cannot say 'require MFA from outside the office but not inside'. You cannot exclude a specific user or application. You cannot set different requirements for different risk levels. Security Defaults applies the same rules to everyone under every circumstance.

Conditional Access is the granular policy layer in Microsoft Entra ID. Rather than a single on/off switch, it lets you define policies that evaluate context before allowing access: who is the user, what are they trying to access, what device are they on, where are they signing in from, and what is their sign-in risk level?

A Conditional Access policy might say: all users must use MFA. Or: users must use MFA unless they are on a managed, compliant device and signing in from a known location. Or: block access to Exchange Online from any device that is not enrolled in Intune. Or: require MFA for administrators at every sign-in, regardless of device or location.

Conditional Access gives you the flexibility to match your security policy to how your business actually operates. It also lets you respond to specific risks — for example, blocking sign-ins from countries where you have no legitimate users.

This is the critical technical point. Security Defaults and Conditional Access are mutually exclusive. When you enable Conditional Access policies, Microsoft requires you to disable Security Defaults. When Security Defaults is enabled, Conditional Access policies cannot be applied.

This means that moving from Security Defaults to Conditional Access is a deliberate migration. You disable Security Defaults, then configure Conditional Access policies that replicate (and extend) what Security Defaults was doing, then enable those policies. If you disable Security Defaults without having Conditional Access policies in place, you are temporarily running with no baseline controls.

This migration needs to be handled carefully. The period between disabling Security Defaults and enabling correctly configured Conditional Access policies is a window of reduced protection.

Security Defaults is the right starting point for very small tenants (under five users) with limited complexity and no Business Premium licence. It is better than nothing and costs nothing.

Conditional Access is the right choice for any organisation that has Business Premium, operates with remote workers or personal devices, has compliance requirements, or needs to do anything more sophisticated than blanket MFA for everyone. This describes most Australian SMBs with 10 or more employees.

If you are on Business Premium and still running Security Defaults, you are paying for Conditional Access capability that you are not using. The migration is worth doing.

The most common problem organisations encounter when moving from Security Defaults to Conditional Access is that they disable Security Defaults, create some Conditional Access policies, miss something, and end up with either users locked out or a gap in coverage. Planning the migration in report-only mode first — where Conditional Access policies log what they would do without actually enforcing — significantly reduces this risk.