To secure Microsoft 365 sign-ins, require multifactor authentication (MFA) for users and administrators, block legacy authentication, and test access policies before enforcing them. For a fixed baseline without an Entra premium license, use Microsoft Entra security defaults. For more control over who must authenticate and under what conditions, use Conditional Access with at least Entra ID P1. The key safety rule is to replace security defaults protections before switching them off—and keep tested emergency-access accounts outside policies that could lock them out.
Choose security defaults or Conditional Access
Check the tenant’s current subscription and Entra entitlement before choosing. Microsoft’s licensing guidance says Microsoft 365 Business Premium and E3 include Entra ID P1, while E5 includes P2; bundles can change, so verify the current subscription rather than relying on a product name alone. P2 adds risk-based Conditional Access capabilities.
As an Amazon Associate I earn from qualifying purchases.
| Decision | Security defaults | Conditional Access |
|---|---|---|
| License | No Entra premium license required for the defaults baseline. | At least Entra ID P1 is required, according to Microsoft Learn. |
| Controls | Fixed baseline; enable or disable it as a whole. | Custom policies can target users, resources, and conditions. |
| Best fit | Organizations that need baseline protections without granular exceptions. | Organizations with P1 or P2 that need scoped or contextual controls. |
| Rollout consideration | Prepare users for MFA registration and sign-in prompts. | Recreate defaults coverage when switching, then validate policies in report-only mode. |
| Key limitation | Limited customization and constrained method behavior. | Mis-scoped or overlapping policies can produce unexpected access; coverage and exclusions need review. |
Security defaults require MFA registration, require MFA for administrators, prompt users for MFA when necessary, block legacy authentication and device-code flow, and protect privileged activities. Conditional Access is not simply a more powerful switch: it gives you flexibility, but also makes correct policy scope and exclusions your responsibility. See Microsoft’s security defaults documentation and Conditional Access policy templates.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Prepare the tenant before changing sign-in controls
Inventory how people and services authenticate before enabling a baseline or replacing one. A policy change can disrupt older clients, unattended scripts, and special accounts even when ordinary user sign-ins work.
#1 Best Overall
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
- Confirm whether security defaults or Conditional Access is currently active.
- Identify legacy authentication clients, devices, scripts, and other service dependencies; plan their migration rather than weakening the baseline without an explicit risk decision.
- Check whether users and administrators can register the methods your intended policies will require.
- Establish at least two cloud-only emergency-access accounts and decide which policies must exclude them.
- Tell users what registration steps and sign-in prompts to expect.
Enable security defaults when a fixed baseline fits
Security defaults are the straightforward choice when the tenant does not need granular policy exceptions and does not have the required Entra premium license for Conditional Access. Microsoft says the baseline requires users to register for MFA and uses Microsoft Authenticator notifications; users can also use OATH time-based one-time password codes. Registration is through the notification option. Do not disable available methods while relying on security defaults, because doing so can lock the tenant out. Microsoft’s Microsoft 365 MFA setup guidance warns not to turn defaults off unless you are switching to Conditional Access with Entra ID P1 or P2.
Move to Conditional Access without leaving a protection gap
Security defaults and Conditional Access cannot be active together. Turning defaults off first and postponing replacement policies leaves protections missing. Plan and configure the replacement baseline as part of the same change.
- Review Microsoft’s baseline templates. The templates include policies for MFA for all users, MFA for administrators, blocking legacy authentication, and MFA for Azure management. Use Microsoft’s Conditional Access policy templates as a starting point, not a substitute for checking tenant-specific scope.
- Turn off security defaults as you switch. Defaults and Conditional Access cannot run together, so prepare the replacement policies and exclusions before making the transition.
- Recreate the protections. Create the policies that replace the defaults coverage, then add any other policies your organization needs. Review exclusions and special cases rather than assuming the templates fit unchanged.
- Validate, then enforce. Keep new policies in report-only mode while reviewing sign-in results and policy impact. Resolve registration or compatibility problems before switching enforcement on. Microsoft’s templates start in report-only mode, and Microsoft advises testing and monitoring each policy before enabling it.
Scope the all-user MFA policy deliberately
For the broad MFA baseline, Microsoft’s policy guidance recommends including all users and all resources, with no app exclusions, and requiring MFA. Exclude emergency-access accounts from restrictive policies that could block recovery. Depending on the tenant, consider whether directory synchronization accounts or guests need special handling, and document the reason for each exception.
A policy that grants access after MFA only to a selected group does not, by itself, deny access to users outside that group. If users outside the intended scope must not sign in, create and validate a separate deny policy rather than treating an MFA grant policy as a block. Review Microsoft’s all-users MFA policy guidance when building the baseline.
Rank #3
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
Require stronger MFA for administrators
Microsoft recommends phishing-resistant MFA for administrator roles. Before enforcing that requirement, make sure the administrators covered by the policy have already registered a supported method; Microsoft warns that enforcing it before registration can risk tenant lockout. FIDO2 passkeys are one supported path. Choose the authentication strength and built-in roles that match the tenant’s configuration, using Microsoft’s administrator phishing-resistant MFA guidance.
Authentication strength determines which method combinations satisfy a Conditional Access policy. Microsoft lists built-in strengths for multifactor authentication, passwordless MFA, and phishing-resistant MFA. Its cited policy guidance says external authentication methods are currently incompatible with authentication strengths; in that situation, use the ordinary “Require multifactor authentication” grant control and check the documentation again before implementation, because support can change.
Rank #4
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
Protect and test emergency access
Maintain at least two cloud-only emergency accounts, protected with strong independent authentication such as FIDO2 passkeys or certificate-based authentication. Exclude them from enforced policies that could require an unavailable device or otherwise prevent sign-in. Monitor their use and test them regularly: Microsoft gives quarterly testing as an example and summarizes validation at least every 90 days. See Microsoft’s emergency-access account guidance.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Account for service principals and older sign-in methods
User-scoped Conditional Access does not automatically protect service principals. Microsoft recommends workload-identity Conditional Access for service principals and replacing script or code credentials with managed identities where possible. Separately, blocking legacy authentication can break older clients or devices, so identify and migrate those dependencies instead of quietly weakening the baseline.
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Per-user MFA is a last option in Microsoft’s guidance when security defaults or Conditional Access cannot be used. It is not the preferred substitute for a tenant-wide baseline built with either of those approaches. For Microsoft’s MFA licensing details, see Microsoft Entra multifactor authentication versions and consumption plans.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
