With Free Microsoft Entra ID licence, can we disable security defaults setting ?

EVE 20

When administrator log in in the azure (they use MFA), they are informed that security defaults setting will be applied for the organization in xxx days.

When this default setting will be automatically applied , will we be able to disable the defaults settings even if we have free Entra ID licence ? I found the relevant button in the azure portal to do it. I just want to be sure that this option will not be disabled in the portal later on.

I'm not sure of what I read from the documentation.

From a mid-long term view, is there is free entra ID licence to force organisation to use security default settings ?

Thank you in advance

EVE 20 Reputation points

2023-11-16T09:08:53.6533333+00:00

Thank you for your answers.

However, they seem contradictory.

Another user may have performed this devalidation of the default settings in recent days even though he has a free Entra license???

or can someone from Microsoft answer this question or validate an answer ?
!Daniel Bradley 1,061 Reputation points MVP

2023-11-16T10:38:22.77+00:00

I have updated my answer.

Accepted answer

!Daniel Bradley 1,061 Reputation points MVP

2023-11-15T14:28:59.9+00:00

You can but shouldn't disable security defaults using the Free version of Microsoft Entra.

At a bare minimum, you can purchase a single Microsoft Entra P1 license and then disable Security defaults in favour of Conditional Access, where you can make exceptions. However, for any user impacted by Conditional Access, they will need to be assigned a license.

I hope this answers your question!

Kind regards

Daniel

https://www.linkedin.com/in/danielbradley2/
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

TP 95,221 Reputation points

2023-11-15T23:46:25.4166667+00:00

Hi,

You can disable Security Defaults with Entra ID Free. There has been no public announcement of forcing all organizations using Entra ID Free to use Security Defaults without ability to disable it.

Whether or not they will force it in the long term is up for debate.

Please click Accept Answer and upvote if the above was useful.

Thanks.

-TP
Please sign in to rate this answer.
TP 95,221 Reputation points

2023-11-16T19:29:41.4166667+00:00

@EVE There is no requirement to have a Entra P1 license in order to Disable Security Defaults. I have done this yesterday, plus other times over past year+ since automatic enablement of Security Defaults started.

Additionally, I see no reason to purchase a single P1 license, unless you need P1 features for 1 user account only.

You can have Security Defaults or Conditional Access, but not both. Right now you have neither, but based on your description you are using Per User MFA, which you can think of as "partial Security Defaults".

In order to get most of the security benefits provided by Security Defaults using Conditional Access you would need a P1 license for almost all of your users, not just one.

Primary complaint people have with Security Defaults in my experience is that it applies to all users, no exceptions. The solution to this is to a) leave Security Defaults disabled (less secure, what you are doing now) or b) use Conditional Access instead.

If you choose Conditional Access, to comply with the license terms you will need at least P1 licenses for almost all users. Your subscription(s) can be audited at any time, and if you are using P1 features without having enough licenses you are subject to penalty (in addition to buying required licenses), unless the overage is only small percentage.

To be clear I'm a big proponent of Entra P1 and Conditional Access, however, I didn't want you to think you must purchase P1 just to keep your tenant as it is now, which is Security Defaults Disabled.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

With Free Microsoft Entra ID licence, can we disable security defaults setting ?

1 additional answer

Your answer