enabling the security defaults setting in your tenant that includes multifactor authentication

Question

enabling the security defaults setting in your tenant that includes multifactor authentication

Jim Lawson 0

Do you know anything about this Microsoft 2FA security enforcement?

I have this same email from Microsoft for 3 clients

I have tried following Microsoft links and information and going around in circles.

It must be referring to O365 2FA security enforcement, but I'm not sure.

Cheers, and thank you..

Jim ******@keycom.net.au

Andy David - MVP 160.3K Reputation points MVP Volunteer Moderator

2023-05-04T11:30:34.53+00:00

Which email is this?

1 answer

Your answer

Andy David - MVP 160.3K Reputation points MVP Volunteer Moderator

2023-05-04T11:30:34.53+00:00

Which email is this?

Answer 1

JamesTran-MSFT 37,256 Microsoft Employee Moderator

@Jim Lawson

Thank you for your post and I apologize for the delayed response!

When it comes to the email that you received, if your tenant isn't leveraging Security Defaults, Conditional Access Policies, etc..., the Security Defaults feature will be enabled automatically. However, after this is enabled, you'll still be able to disable Security Defaults within your Azure AD tenant.

User's image

Note: Please keep in mind that since we're always working to improve the security of Microsoft cloud services, if you aren't leveraging CA Policies, Security Defaults, etc., to protect your tenant, you'll receive this email again in the future.

Additional Links:

The security defaults setting for your xxxxx tenant will be turned on - Related issue.
Emergency access accounts - In addition to the recommended action(s), I'd also make sure you have emergency accounts to prevent being locked out of your Azure tenant.
Raising the Baseline Security for all Organizations in the World

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Jim Lawson 0 Reputation points

2023-05-16T00:24:38.7866667+00:00

Thank you for the reply James. Another un-authorised and unrequested modification to functionality of my service, done by Microsoft. I have been assured by Microsoft support that this new and forced security is only being pushed to admin accounts. Can you confirm that is the case?

Thank you, Jim.
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator

2023-05-16T18:51:46.53+00:00

@Jim Lawson

Thank you for following up on this!

Would you be able to share the support request number and I will gladly look into your support ticket to confirm that this is only going to be pushed to admin accounts.

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Jim Lawson 0 Reputation points

2023-05-17T00:56:15.3133333+00:00

Thank you James. Microsoft support engaged directly with me several times over this issue. Mainly, they were having trouble disabling email OTP. They never actually provided any evidence on my original request, other than assuring me that this security 2FA would only be pushed to O365 admin accounts.

Service Request #: <<Removed SR Number>>

Service Request Title: Security default settings - 2FA settings

Closed Date: 5/12/2023 5:57:31 PM UTC

I look after hundreds of Microsoft O365 email accounts across 40 different medical businesses, and it is a large task for my engineers to modify anything, especially when Microsoft push setup/service changes that we don't want and we have not requested. The whole process lacks in clarity and warning, and is not professional in my opinion.
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator

2023-05-17T18:13:56.8133333+00:00
@Jim Lawson

Thank you for the quick follow up on this!

I reviewed your support request and the engineer's email regarding Admins was referencing the Security Defaults Email being sent to all the Global Admins.

However, when it comes to the automatic enablement of the Security Defaults feature, and if the email you received is the same/similar to the one in my initial answer - the Security Defaults enforced policy will apply to all users within your Azure AD tenant.

For more info - Security Defaults enforced security policies.

All users in your tenant must register for multifactor authentication (MFA) in the form of the Azure AD Multifactor Authentication. Users have 14 days to register for Azure AD Multifactor Authentication by using the Microsoft Authenticator app or any app supporting OATH TOTP. After the 14 days have passed, the user can't sign in until registration is completed. A user's 14-day period begins after their first successful interactive sign-in after enabling security defaults.

Note: After registration with Azure AD Multifactor Authentication is finished, select Azure AD administrator roles will be required to do MFA every time they sign in.

Note: After Security Defaults is enabled, you can disable Security Defaults within your Azure AD tenant to avoid any login issues for your users.

Additional Link:

Microsoft 365 Turn Security defaults on or off

I hope this helps to clarify things! Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Jim Lawson 0 Reputation points

2023-05-17T23:41:48.0566667+00:00

Thank you James.

I'm surprised if this is the only Microsoft knowledgebase thread regarding this issue.

I am not surprised at conflicting and opposing advice from Microsoft.

I tend to believe you, but I need some evidence or better explanation than the one you have provided. Can you do that?
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator

2023-05-17T23:54:52.43+00:00

@Jim Lawson

Thank you for following up on this!

I was able to confirm this with our MFA Product Team within this related thread. I'm currently working with them to add a note or message within the Security Defaults documentation to hopefully help alleviate any future confusion, or questions regarding the automatic enablement of the Security Defaults feature.

If you have any other questions, please let me know.

Thank you again for your time and patience throughout this issue!
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator

2023-05-19T17:02:30.6466667+00:00

@Jim Lawson

Since I'm currently working with our MFA Product Team on this GitHub issue to add a note/message to the Security Defaults documentation, I just wanted to check in and see if you had any other questions?

Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator

2023-05-25T16:34:27.7466667+00:00

@Jim Lawson

Because it's been a few days, I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

Thank you again for your time and patience throughout this issue!
JamesTran-MSFT 37,256 Reputation points Microsoft Employee Moderator

2023-06-01T18:35:44.9+00:00

@Jim Lawson

Thank you for your time and patience on this!

I wanted to follow up and let you know that we were able to add a note/message to the Security Defaults documentation to help alleviate any future confusion for customers.

I hope this helps!

If you have any other questions, please let me know.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Share via

enabling the security defaults setting in your tenant that includes multifactor authentication

1 answer

Your answer