The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Review a Microsoft Entra tenant in this order: identify whether Security Defaults or Conditional Access is enforcing the baseline, secure administrator sign-ins with multifactor authentication, audit privileged roles, close unsafe protocol paths, migrate retiring risk policies, and verify every change with report-only results and sign-in evidence. The right configuration depends on licensing, applications, workforce, and recovery requirements; no single policy set fits every organization.
1. Confirm which security baseline is active
Before changing an individual control, establish whether the tenant is governed by Security Defaults or by Conditional Access. A baseline must be active; treating both as interchangeable or turning one off without a replacement creates a protection gap.
As an Amazon Associate I earn from qualifying purchases.
Security Defaults: a simpler starting point
Security Defaults are designed for organizations that need a straightforward, Microsoft-managed baseline with limited customization. They are useful when the tenant does not need detailed exceptions, application-specific rules, or conditions based on device, location, risk, or role. The tradeoff is that administrators have fewer ways to tailor requirements to unusual applications or user groups.
Free tools Windows power users keep installed
One-click scans. No signup required.
Conditional Access: more control, more responsibility
Conditional Access provides granular policy conditions and controls, but it requires the relevant Microsoft licensing and deliberate administration. It is the better fit when you need separate treatment for administrators, contractors, applications, device states, locations, or sign-in risk. More flexibility also means more opportunities for conflicting policies, overly broad exclusions, and accidental lockout, so policy ownership and testing matter.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Decision axis | Security Defaults | Conditional Access |
|---|---|---|
| Licensing | Specific additional licensing requirement is not stated in the Microsoft guidance summarized here. | Requires the relevant Conditional Access licensing. |
| Customization | Limited; intended as a simple baseline. | Granular conditions, controls, and exceptions are available. |
| Operational complexity | Lower, because fewer policy decisions are exposed. | Higher; administrators must design, test, document, and maintain policies. |
| Migration risk | Cannot run at the same time as Conditional Access. | Replacement policies must reproduce the required baseline before Security Defaults are disabled. |
Questions to answer before choosing
- Do your users, administrators, and applications need different access requirements?
- Do you need conditions based on device, location, application, or risk?
- Can your licensing support the Conditional Access controls you intend to deploy?
- Who will own policy design, exception approval, testing, and incident response?
- Can you maintain an inventory of service accounts, older clients, and emergency access accounts?
If the answer to these questions is no, the simpler baseline may be the more dependable choice. If the answer is yes, Conditional Access may be appropriate, but only with a documented operating model.
Safe migration sequence
- Document what Security Defaults currently require in your tenant, including MFA registration and any protocol restrictions that affect applications.
- Confirm that the tenant has the licenses required for the Conditional Access policies you intend to use.
- Create the replacement Conditional Access policies and put them in report-only mode where possible.
- Use policy impact information and sign-in logs to find users, applications, and service accounts that would be affected.
- Register administrators for the authentication methods the replacement policies will require.
- Test normal users, privileged users, guests, mobile clients, desktop clients, and non-interactive sign-ins that could match the policies.
- Document each exception, its owner, its business reason, and its review date.
- Only after the replacement protections are tested and ready, switch the baseline. Microsoft states that Security Defaults and Conditional Access cannot be enabled simultaneously.
Do not disable Security Defaults first and plan to recreate protection later. The transition should leave a working baseline in place throughout the change. A rollback plan should identify who can change the baseline and how emergency access will be used if the first Conditional Access deployment behaves unexpectedly.
2. Require MFA for administrators, then extend it to users
Multifactor authentication is the next review because a stolen password should not be enough to enter an administrator account. Microsoft’s guidance prioritizes MFA for administrator accounts and then recommends extending it to all users. Review the authentication methods your workforce can actually use rather than selecting a requirement that excludes critical staff.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Inventory administrator authentication
- List every account with an Entra directory role, including accounts used only for occasional support.
- Check whether each administrator has completed MFA registration and whether the registered methods are still usable.
- Identify accounts that cannot complete an interactive challenge, such as automation identities, and handle them through an appropriate design rather than silently excluding them.
- Confirm that emergency recovery accounts remain available for a genuine tenant lockout.
- Record the owner and recovery contact for each privileged account so an incident responder is not searching for this information during an outage.
Choose phishing-resistant methods for privileged roles
For administrators, assess whether phishing-resistant MFA is appropriate for the organization’s risk and operating model. Microsoft guidance identifies FIDO2 passkeys as a supported method; a compatible physical security key is optional, not a universal requirement. Check device, browser, platform, and account compatibility before selecting a method for every administrator. Consider whether administrators need more than one registered method so that loss of a device does not become a lockout, while still controlling which backup methods are accepted.
Register methods before enforcement
Enrollment must precede a policy that requires a particular method. Microsoft warns that enabling enforcement before administrators have registered supported methods can lock out the tenant. Use a staged rollout: enroll a small administrator group, verify successful sign-ins, expand to the remaining privileged accounts, and then apply the requirement to the wider user population. Communicate the enrollment deadline, provide a support route, and keep a tested recovery procedure separate from ordinary user help-desk processes.
Microsoft’s Security Defaults documentation associates removal of the 14-day MFA registration grace period with protection against “over 99.2% of identity-based attacks.” The page does not state a study year or identify the underlying study, so treat this as Microsoft’s contextual claim rather than an independently verified statistic.
Extend protection without creating avoidable exceptions
After administrators are protected, review the remaining users, guests, and contractors. Decide whether the same method requirement is practical for each population and whether application dependencies need a staged rollout. An exception should have a named owner and an expiry or review date; a permanent, undocumented exclusion can become an unmonitored path around the baseline.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Audit privileged roles and reduce standing access
MFA protects a sign-in, but it does not make an unnecessary role assignment safe. Review who can change identities, authentication policies, applications, subscriptions, and security settings. Examine both direct assignments and access inherited through groups.
Build a role-assignment inventory
- Export or review all active directory-role assignments, including assignments inherited through groups.
- For each assignment, record the business owner, purpose, scope, and last demonstrated need.
- Remove roles that are obsolete, duplicated, broader than the job requires, or assigned to a personal account when a managed administrative account is available.
- Separate everyday work accounts from accounts used for privileged administration where your operating model supports that separation.
- Check whether a role is needed continuously or only for a particular change window or incident.
Apply least privilege: each administrator should have only the access needed for the job, and only for the resources that job covers. A person who administers applications may not need authority over identity policies, and a help-desk role may not need tenant-wide permissions. Make the scope and purpose explicit so a reviewer can challenge an assignment without relying on tribal knowledge.
Use time-limited elevation when the tenant supports it
Where licensing and operations support privileged-access management, consider just-in-time activation instead of permanent role membership. A time-limited activation can require approval, MFA, or a reason before elevated access is granted. The exact workflow depends on the tenant’s licensing and operational requirements, so document who approves activation, how long activation lasts, and how urgent access is handled. Test the process with an administrator who has to activate a role during a realistic maintenance task.
Schedule access reviews
Access reviews help role owners confirm that assignments are still justified. Set a review frequency that matches the sensitivity of the role and the rate at which staff and responsibilities change. Record the reviewer’s decision and remove access when the review finds no continuing need. A review that only records approvals without checking actual use can preserve stale access, so compare the assignment with current responsibilities and recent administrative work where that evidence is available.
Preserve emergency recovery access
Keep a controlled emergency path for recovering the tenant if ordinary administrator accounts or policies fail. Protect those accounts differently from normal administrators, limit their use to recovery, and monitor their sign-ins. Do not include emergency access in a broad exclusion simply because testing is inconvenient; test the recovery procedure deliberately and keep the credentials available to the people responsible for an incident. Document when an emergency account may be used, who authorizes use, and how the credentials are rotated afterward.
4. Check protocol exposure before tightening access
Block legacy authentication where it is no longer needed
Legacy authentication protocols generally cannot satisfy modern MFA and Conditional Access requirements. Identify devices, scripts, mail clients, and line-of-business applications that still use them. Block legacy authentication where the business dependency has been removed, and create a migration plan for anything that still relies on it. A blanket change without an application inventory can interrupt service accounts or older clients.
Use sign-in evidence and application-owner interviews to distinguish an active dependency from an old configuration that is no longer used. For each remaining dependency, record the application owner, replacement plan, testing date, and temporary risk acceptance. Revisit that record rather than allowing a temporary exception to become permanent.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Investigate device-code flow dependencies
Device-code flow can be useful on devices without a conventional browser, but it also deserves explicit review because it can be abused in phishing scenarios. Microsoft’s Security Defaults documentation states: “Starting July 1, 2026, all new Microsoft Entra tenants block device code flow as part of security defaults.” The date applies to new tenants; existing tenants should still be assessed for applications and administration tools that depend on the flow.
Recommended Free Tools
Before tightening this control, search sign-in and application documentation for device-code usage, test replacement authentication, and communicate any required client updates. Include administrative tools, scripts, and unusual operational environments in the test plan. Treat a failed test as an application dependency to resolve, not as a reason to leave an unsafe protocol permanently unexamined.
5. Replace retiring Identity Protection risk policies
Review tenants that use the older Identity Protection user-risk or sign-in-risk policies. Microsoft says these legacy policies retire on October 1, 2026. Plan migration to Conditional Access before that date rather than waiting for policy behavior to change. Because licensing and policy behavior vary by tenant, confirm both before building the replacement.
Migration checklist
- Inventory every legacy user-risk and sign-in-risk policy, including its thresholds, included users, exclusions, and required controls.
- Confirm that the tenant has the licenses needed for the corresponding Conditional Access risk conditions.
- Create Conditional Access policies that represent the intended response to user risk and sign-in risk.
- Compare the new policy scope with the old policy so that a missing group, changed threshold, or broader exclusion is visible.
- Use report-only mode and policy-impact information to identify unexpected matches, service accounts, and break-glass exclusions.
- Test sign-in and remediation behavior with representative administrator and user accounts.
- Enable the replacement policies before the stated retirement date, then remove obsolete policies and update the change record.
Risk signals are not a substitute for role review or MFA. They are an additional input that can change the access decision when a sign-in or account appears risky. Document what the organization wants to happen at each risk level, who handles remediation, and how a false positive is investigated.
6. Test every policy before enforcement
Conditional Access changes should be treated as production changes, not as settings to toggle and hope will work. Report-only mode lets you observe what a policy would do while users continue to sign in under the existing controls.
Use report-only and policy impact tools
- Place a new policy in report-only mode when the control supports it.
- Use the policy impact view to estimate affected users, applications, and sign-in scenarios.
- Test administrator, standard-user, guest, mobile, desktop, browser, and non-interactive sign-in paths that the policy could match.
- Include a user who should be allowed, a user who should be challenged, and a user who should be blocked.
- Record intended exclusions, their owners, and the date on which each exclusion will be reviewed.
- Have someone other than the policy author review the scope and expected result before enforcement.
Read sign-in logs after a change
After enforcement, inspect the sign-in logs for policy results and authentication details. Confirm that the expected policy applied, the expected MFA method was used, and the intended application or device condition was evaluated. Check both successful and failed sign-ins so that a policy that appears correct for administrators does not silently block a business workflow.
Sign-in data can initially be incomplete. Allow for collection and processing time before drawing conclusions from a new policy. IP-based location is also only a best-effort estimate; a mapped city or country is not definitive proof of a user’s physical location. Use location as one signal alongside identity, device, application, and risk information. Avoid treating a single unexpected location as proof of compromise without corroborating evidence.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep a recovery path during rollout
Make changes in a planned window, retain tested emergency access, and stage enforcement rather than changing every user at once. If a policy causes unexpected blocking, use the sign-in event to identify the matching policy and condition, pause or narrow the policy as appropriate, and correct the underlying assignment or exclusion. Do not solve a policy error by permanently excluding an entire administrator population. Record the incident, the corrective change, and the follow-up test.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. A practical first-review worksheet
Capture the following facts before approving changes. This turns a one-time settings check into an auditable security review.
| Area | Record | Decision to make |
|---|---|---|
| Baseline | Active baseline, licensing, policy owners, and documented exceptions | Keep Security Defaults or build and test Conditional Access |
| MFA | Administrator enrollment, supported methods, rollout groups, and recovery contacts | Require MFA now and decide whether phishing-resistant methods are required for administrators |
| Roles | Every privileged assignment, purpose, scope, and review date | Remove excess access and use time-limited elevation where supported |
| Protocols | Legacy-authentication and device-code dependencies by application | Block unused paths and schedule remediation for required clients |
| Risk | Legacy risk policies, equivalent Conditional Access policies, and license status | Complete migration before October 1, 2026 |
| Validation | Report-only results, sign-in evidence, test cases, and rollback owner | Enforce only after expected and unexpected effects are understood |
8. Questions administrators commonly ask
Should I use Security Defaults or Conditional Access?
Use Security Defaults when a simple baseline with limited customization meets the tenant’s needs. Consider Conditional Access when you need granular conditions, exceptions, or separate treatment for roles, applications, devices, locations, or risk, and when the required licensing is available. The two approaches cannot be enabled simultaneously, so build and test replacement policies before switching.
How do I require MFA for Entra administrators?
First inventory every privileged account, confirm supported methods, and have administrators register before enforcement. Then stage the requirement with a small group, verify sign-ins, expand to the remaining administrators, and extend protection to other users. Assess phishing-resistant methods such as FIDO2 passkeys for privileged roles, including compatibility and backup-method needs.
Can I turn off Security Defaults temporarily while I build Conditional Access?
Do not create an unprotected gap. Microsoft states that Security Defaults and Conditional Access cannot run together, so prepare and test the replacement controls first, then switch the baseline during a planned change window with recovery access available.
How can I test a Conditional Access policy before turning it on?
Use report-only mode and policy-impact information, then test representative administrator, user, guest, device, application, and non-interactive sign-in paths. After enforcement, review successful and failed sign-ins, policy results, and authentication details. Allow for initial data delay before drawing conclusions.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat should I do about legacy authentication?
Identify clients, scripts, and service accounts that still depend on it. Block the protocol where the dependency has been removed and create a dated migration plan for anything that remains. Validate the replacement before applying a broad block.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What is changing on October 1, 2026?
Microsoft says legacy Identity Protection user-risk and sign-in-risk policies retire on that date. Inventory those policies now, confirm licensing, build equivalent Conditional Access policies, test them in report-only mode, and enable the replacements before retirement.
Is a location shown in a sign-in log definitive?
No. IP-based location is a best-effort estimate. Treat the mapped city or country as one signal and evaluate it with identity, device, application, and risk evidence.
When to repeat the review
Repeat this sequence after a licensing change, a major application rollout, an acquisition, a change in administrator responsibilities, or an authentication incident. Microsoft guidance and product behavior can change, so recheck the current Security Defaults, device-code, licensing, and risk-policy documentation before a date-sensitive migration—especially as the October 1, 2026 retirement approaches.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Frequently Asked Questions
Which Microsoft Entra security setting should an administrator review first?
Confirm whether Security Defaults or Conditional Access is the active baseline. Do not disable one until the replacement protection is designed, licensed, tested, and ready.
Should administrators use phishing-resistant MFA?
Assess phishing-resistant methods for privileged roles, including FIDO2 passkeys, based on risk, compatibility, and operational support. Register methods before enforcing them.
How do I avoid locking out the tenant during MFA rollout?
Enroll and test administrators in stages, preserve controlled emergency access, and use report-only testing where applicable before broad enforcement.
When must legacy Identity Protection risk policies be replaced?
Microsoft states that the legacy user-risk and sign-in-risk policies retire on October 1, 2026. Migrate to tested Conditional Access policies before that date.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Bottom Line
Start with the active baseline, then secure administrator sign-ins with MFA, reduce standing privilege, review legacy and device-code protocols, and migrate retiring risk policies. Test every change in report-only mode where possible, verify results in sign-in logs, and keep a tested recovery path. Licensing, application dependencies, and tenant needs determine the exact implementation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
