The Free Control That Closes Most of What a Small Organisation Gets Wrong

A recurring situation in small organization security: the two most damaging gaps are usually multi-factor authentication coverage and legacy authentication, and the recommended fix is usually Conditional Access, which the organization does not have licensed.

The conversation then becomes a procurement conversation, and the gaps stay open for however long procurement takes.

There is a control that closes both, costs nothing, and is available on every Microsoft 365 subscription. It is frequently overlooked because it is not configurable, and security guidance tends to favour things you can configure.

What Security Defaults Do

Security Defaults is a single tenant-wide toggle. Switched on, it:

• Requires multi-factor authentication registration for all users
• Requires multi-factor authentication for administrative roles
• Blocks legacy authentication protocols
• Requires re-authentication when risk is detected

That is most of the baseline. It is available on every subscription tier, including the entry-level plans small organizations actually buy.

The Trade-Off

It cannot be customised. No exclusions, no named locations, no per-application scoping, no report-only mode. It is on or it is off.

That is a genuine cost and it should not be minimised. In practice it means:

Legacy authentication breaks immediately for anything using it. A
multi-function printer scanning to email, a line of business application
sending notifications, a member of staff using a third-party mail client. All
of these stop working at the moment the toggle is set, with no grace period
and no exclusion available.

• There is no phased rollout. Everyone is enrolled, and support handles the
• consequences.

For an organization with genuine legacy dependencies and no capacity to migrate them quickly, that is disruptive enough to matter.

Why It Usually Wins Anyway

Compare it against the realistic alternative, which is not Conditional Access. It is nothing, for another six months, while the licensing question works its way through a budget cycle.

An imperfect control that is active today protects more than a well-designed control that is scheduled.

There is also a licensing subtlety worth understanding. Conditional Access requires a premium licence for every user a policy applies to. Organisations sometimes hold a single premium licence, typically on the administrator account, which makes the capability visible in the portal. A policy created in that state will function, because enforcement is not gated on licence state in code, but using it beyond entitlement is a licensing breach, and Microsoft now surfaces usage against entitlement in reporting.

So the choice for a small organization is frequently between Security Defaults today at no cost, and Conditional Access after a purchase covering every user. Not between Security Defaults and a free Conditional Access policy.

Doing It Properly

Before switching it on, one query. Find everything using legacy authentication in the last thirty days:

• Group sign-in events by account and client, filtered to legacy protocol
• identifiers, and look at which accounts appear and what software they are
• running.

That list is the disruption. Usually it is short, and usually it is a printer, a scan-to-email function and one or two people using a third-party mail client. Each has a modern equivalent and the migration is measured in hours.

Do that first. Then switch on Security Defaults, and you have closed the two largest gaps in an afternoon rather than a quarter.

When Conditional Access Is Genuinely Required

It is the right answer when you need conditions rather than a baseline:

• Exempting a service account that cannot support a second factor
• Restricting access by location or by device compliance
• Applying different requirements to different applications
• Testing a policy in report-only mode before enforcement
• Session controls such as sign-in frequency

Those are real requirements and Security Defaults cannot meet them. But they are requirements of organizations with the operational maturity to use them, and an organization that has not yet enrolled its staff in multi-factor authentication is not that organization yet.

Get the baseline in place. Buy the flexibility when you have something to be flexible about.