Security Defaults vs Conditional Access for Texas SMBs

Security defaults are a single on/off toggle in Entra ID, free on every tenant, no license required. Flip it on and Microsoft enforces a fixed bundle of rules for every user, with zero customization:

• All users must register for MFA within a grace period, no exceptions.
• Admins get MFA challenges every time they sign in, not just occasionally.
• Legacy authentication protocols (POP, IMAP, older SMTP auth, basic auth) are blocked tenant-wide.
• Device code flow sign-ins are blocked, which closes off a phishing technique attackers have leaned on.
• Access to Azure management (the Azure portal, PowerShell, CLI) requires MFA.

That's the whole list. You can read Microsoft's own description of the feature set at Microsoft Learn's security defaults documentation. It's a reasonable baseline for a five-person shop with no budget and no IT staff. It is not designed to flex for anyone else.

The design philosophy behind security defaults is "no exclusions, period." That's exactly why the copier stopped working. Scan-to-email devices, shared mailboxes used for monitored inboxes, line-of-business service accounts that run scheduled jobs overnight, and any application using an older auth protocol all get treated the same as a human logging in from a laptop. There is no policy editor, no "exclude this account," no conditional logic based on location or risk. It's all users, all the time, or nothing.

That rigidity is precisely why credential-based attacks keep working against businesses that have no MFA at all. Credential abuse shows up at some point in 39% of breaches according to the Verizon 2026 DBIR — which makes the "no exclusions" stance less annoying once you understand what it's defending against. The problem isn't the intent. It's that most mid-size businesses have at least one legacy device or service account that can't do modern auth, and security defaults gives you no room to handle it gracefully.

One exclusion already exists, and it's worth knowing about: the Entra Connect (Azure AD Connect) sync account is excluded from security defaults automatically. Microsoft built that in because breaking directory sync would be worse than any security gain. Everything else — your copier, your fax-to-email gateway, your after-hours batch job — gets no such courtesy.

Conditional Access policies require Entra ID P1, which ships inside Microsoft 365 Business Premium and most E3/E5 bundles. If your tenant is on Business Basic or Standard without Premium, you'll need to add the P1 license per user before Conditional Access is available at all. That's the real cost line item here — not a product fee, a license tier decision.

What you get in exchange is granularity. You can require MFA for everyone except a tightly scoped service account, block sign-ins from outside the U.S., require a compliant device for finance staff, or demand MFA only when sign-in risk is elevated. If your business falls in the 20-99 employee range, this granularity also matters for Texas SB 2610: implementing CIS Controls IG1 (56 safeguards) shields you from exemplary damages in a breach lawsuit, and Conditional Access policies are a core piece of satisfying several of those safeguards — see the bill text at the Texas Legislature's SB 2610 page.

The mistake we see most often is a business disabling security defaults the moment they buy P1 licenses, intending to "build Conditional Access policies later." That later never arrives fast enough, and the tenant runs naked for days or weeks. Don't do it that way. Here's the sequence that keeps you covered the entire time:

• Buy and assign Entra ID P1 to all users who'll be in scope.
• In the Entra admin center, go to Conditional Access and enable the Microsoft-managed policies — these are Microsoft's pre-built templates that mirror security defaults functionality (require MFA for admins, require MFA for all users, block legacy auth) but live as editable Conditional Access policies.
• Set each Microsoft-managed policy to Report-only mode first. Let it run for a week and review the sign-in logs for anything that would have been blocked — this is where you catch the copier, the shared mailbox, the service account.
• Build the exclusions or exceptions you need directly into the policy (a scoped group for service accounts, a named-location exception for a monitored office IP).
• Flip each policy from Report-only to On, one at a time, confirming nothing breaks after each switch.
• Only after all equivalent Conditional Access policies are On do you disable security defaults. Never disable defaults first and build policies after — that's the gap that gets tenants breached.

If you haven't set up MFA registration yet, handle that first — we cover the exact rollout in our MFA setup guide, and once Conditional Access is live, the natural next step is layering in the baseline policy set we detail in our 8 Conditional Access policies every business needs post. We won't re-cover either here.

For businesses handling PHI or financial data, Conditional Access isn't optional dressing — it's part of satisfying HIPAA or FTC Safeguards Rule access-control requirements, and pairing it with privileged access management closes the gap on admin accounts specifically.

Can I run security defaults and Conditional Access at the same time?

No. Microsoft blocks you from enabling security defaults if any Conditional Access policies exist, and vice versa. They're mutually exclusive by design, which is exactly why the switchover sequence matters — you have to stage Conditional Access policies in Report-only mode before you can safely turn defaults off.

Do I need Entra ID P1 for every user, or just admins?

Licensing follows whoever is in scope of a Conditional Access policy. If a policy applies to all users, every one of those users needs a P1 license (or an included bundle like Business Premium or E3/E5). You can scope policies narrowly to reduce license spend, but then those excluded users get no Conditional Access protection at all.

What happens to our copier and service accounts during migration?

Report-only mode is what saves you here. It logs what would have been blocked without actually blocking it, so you can identify every legacy device or service account before you flip anything live, then build a scoped exclusion or migrate that device to modern auth.

Is security defaults ever the right permanent choice for a growing business?

For a very small shop with no legacy hardware, no service accounts, and a flat budget, yes — it's free and it stops the most common credential attacks. The moment you add a copier with scan-to-email, a monitored shared mailbox, or any compliance obligation, you've outgrown it and need Conditional Access.

If you're not sure which side of that line your business sits on, our free IT assessment will map your tenant's current auth gaps in under an hour. Or just reach out and we'll walk the Entra admin center with you.