Security Defaults vs Conditional Access: Which One Should a Small Business Use?

By Justin N. · Updated 2026-10-22 · This page may contain affiliate links

Every Microsoft 365 tenant needs some baseline sign-in protection. Microsoft gives you two ways to get it: security defaults, a free on/off switch, and Conditional Access, a set of rules you build yourself. You can't run both at once. Here's what each one does, which one fits a 5–50 person business, and how to switch without leaving a gap.

Who this is for: a small business on Microsoft 365 that isn't sure whether security defaults are on, or whether it's paying for Conditional Access without using it. Everything below was checked against Microsoft Learn on 2026-10-22.

The short answer

No Microsoft Entra ID P1 license? Leave security defaults on. Microsoft says they're meant for organizations on the free tier of Entra ID, and they cost nothing (Security defaults).
Have Microsoft 365 Business Premium (or E3)? You already own Entra ID P1, which is what Conditional Access needs (Microsoft Entra licensing). Microsoft says organizations with P1 or P2 licenses probably shouldn't stay on security defaults. Move to Conditional Access, carefully.
Never turn security defaults off before your Conditional Access policies are ready. That's the one mistake that leaves the whole tenant without MFA.

What security defaults actually do

According to Microsoft, turning on security defaults (Security defaults):

Requires every user to register for multifactor authentication (MFA). Users register with the Microsoft Authenticator app using notifications. Codes from Authenticator or another OATH TOTP app also work for sign-in.
Requires MFA every time someone in a listed admin role signs in. The list includes Global Administrator, Exchange Administrator, SharePoint Administrator, User Administrator, and others.
Prompts everyone else for MFA "when necessary." Microsoft decides when, based on things like location, device, role, and task. You can't tune it.
Blocks legacy authentication: clients that don't use modern authentication (Microsoft's example is an Office 2010 client) and anything that uses older mail protocols such as IMAP, SMTP, or POP3.
Blocks device code flow sign-ins. Microsoft notes that starting July 1, 2026, all new tenants block device code flow as part of security defaults.
Requires MFA for anyone using Azure management tools: the Azure portal, Microsoft Entra admin center, Azure PowerShell, and Azure CLI.

Microsoft also says security defaults might already be on if your tenant was created on or after October 22, 2019, because they're rolled out to new tenants at creation. Tenants that have no Conditional Access policies, no premium licenses, and no active legacy authentication clients are periodically notified that security defaults will be turned on automatically.

Check your scanner first. Because security defaults block legacy authentication, a copier or app that sends email with a plain username and password over SMTP can stop working. Microsoft's security defaults article links to its guidance on setting up multifunction devices to send email through Microsoft 365. Test before you turn security defaults on.

What Conditional Access adds

Conditional Access is Microsoft's policy engine. It looks at signals such as who's signing in, from which device and location, and to which app, then decides whether to allow access, require MFA, require a compliant device, or block (What is Conditional Access?). That's what lets you do things security defaults can't:

Exclude your two emergency ("break-glass") accounts from lockout-prone rules.
Require MFA for every sign-in, not just when Microsoft decides it's needed.
Require a managed, compliant PC (with Intune) before anyone opens company data.
Require Intune app protection on personal phones.
Test every rule in report-only mode first. Microsoft says report-only policies are evaluated at sign-in but not enforced, and the results show up in the sign-in logs (Report-only mode).

Side by side

This table follows Microsoft's own comparison (Security defaults):

	Security defaults	Conditional Access
License needed	None	At least Microsoft Entra ID P1
Customization	None (on or off)	Fully customizable
Turned on by	Microsoft or an administrator	Microsoft or an administrator
Complexity	Simple to use	As complex as your requirements

Microsoft lists Entra ID P1 as included in Microsoft 365 Business Premium, and in enterprise plans such as Microsoft 365 E3 (Microsoft Entra licensing). If you're comparing plans, see Business Premium vs E3.

Which one should you use?

Check your licenses. In the Microsoft 365 admin center, look under Billing > Licenses. If you don't have Business Premium or another plan that includes Entra ID P1, keep security defaults on.
If you have P1 but nobody has time to maintain policies, security defaults are still better than nothing. My view: a half-finished set of Conditional Access policies is worse than security defaults, so don't switch until you can build the core set in one sitting.
If you have P1 and an hour or two, move to Conditional Access. The Conditional Access starter policies guide has the eight policies I'd build.

How to switch without a gap

Create two emergency access accounts first. Microsoft recommends two cloud-only emergency accounts permanently assigned the Global Administrator role and not tied to a specific person (Security defaults). Give them a strong MFA method too. Microsoft says break-glass accounts also have to sign in with MFA under its mandatory MFA enforcement for Azure and admin portals, and it recommends passkeys (FIDO2) or certificate-based authentication for them (Mandatory MFA).
Build your policies in report-only mode: at minimum, block legacy authentication, require MFA for admins, require MFA for all users, and require MFA for Azure management. Microsoft's guide to blocking legacy authentication is a good first one.
Review the Microsoft-managed policies. Microsoft says managed policies cover the same protections as security defaults (blocking legacy authentication, MFA for Azure management, MFA for admins, MFA for all users). Microsoft turns them on no less than 30 days after they appear in report-only, unless you set them to Off first (Microsoft-managed policies). Decide whether to use them or your own, and exclude your break-glass accounts either way.
Check the report-only results in the sign-in logs for a few days. Use the What If tool to simulate sign-ins (Plan a Conditional Access deployment).
In one sitting, turn off security defaults and turn your policies on. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator, go to Entra ID > Overview > Properties, select Manage security defaults, set it to Disabled (not recommended), and save. Then switch each policy from Report-only to On. Microsoft says organizations should enable Conditional Access policies immediately after disabling security defaults.

Don't also turn on per-user MFA. Microsoft says not to enable or enforce per-user MFA if you use Conditional Access, and that users showing as "Disabled" on the per-user MFA page is expected when MFA comes from security defaults or Conditional Access (Per-user MFA).

Mistakes I'd avoid

Turning off security defaults "to fix one user" and forgetting to turn anything else on.
Building policies without excluding the break-glass accounts.
Ignoring the Microsoft-managed policies, which then switch themselves on and overlap with yours.
Forgetting the scanner, the accounting app, or the shared mailbox that still uses legacy authentication.

Sources

Useful links for this guide: Microsoft's security defaults article · managing emergency access accounts. These are ordinary links, not affiliate links.

Accuracy note: Microsoft changes admin center menus and licensing often. Paths and prices were checked against Microsoft documentation on 2026-10-22. If something has moved, tell me at [email protected].