mail notification // microsoft going to force azure security defaults MFA

Question

Hello,

we received several mails from Microsoft Azure azure-noreply@microsoft.com with the information to enable the tenant security defaults and if this wont be done microsoft will activate them automatically with a delay of 14 days.
Start will be the week February 21, 2023.

Is there an option to deactivate the activation in the background cause we got several customers which need other mfa authentication methods then Microsoft Authenticator.

Answer 1

Hello @Marcel Zimmer

Yes, you can deactivate the activation of the tenant security defaults in Azure Active Directory. According to the documentation, you can manage the authentication methods policy in Azure Active Directory.

Link : https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

Note: Microsoft is making security defaults available to everyone because managing security can be difficult. Identity-related attacks like password spray, replay, and phishing are common in today's environment.
The goal is to ensure that all organizations have at least a basic level of security enabled at no extra cost.

Security defaults make it easier to help protect your organization from these identity-related attacks with preconfigured security settings:

• Requiring all users to register for Azure AD Multi-Factor Authentication.
• Requiring administrators to do multifactor authentication.
• Requiring users to do multifactor authentication when necessary.
• Blocking legacy authentication protocols.
• Protecting privileged activities like access to the Azure portal.

You can find more information about managing authentication methods in Azure Active Directory in the following link: https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/active-directory/authentication/concept-authentication-methods-manage.md

You can also enable per-user Azure AD Multi-Factor Authentication by changing the user state. You can find more information about enabling per-user Azure AD Multi-Factor Authentication in the following link: https://learn.microsoft.com/en-us/azure/active-directory-b2c/multi-factor-authentication?pivots=b2c-user-flow

You can also configure settings for Azure MFA Server in the Azure portal. You can find more information about configuring Azure MFA Server in the following link: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfaserver-deploy

I hope this information helps you.

If this does answer your question, please feel free to mark it as the answer as a token of appreciation.

Answer 2

Having same issue but not seeing the options you show in your azure. will the option i selected below deactivate this?

Answer 3

Hi Adity, I do not believe there is a way to disable the automatic enabling of security defaults. You have to wait for microsoft to turn it on, then turn it back off again. The alternative is to buy 1 license of Azure AD Premium P1 or P2 and then create a conditional access policy. Security defaults cannot be turned on if a conditional access policy exists. This approach entails a small cost.