Microsoft Entra ID tenants should have 'security defaults' enabled
Security defaults in Microsoft Entra ID make it easier to be secure and help protect your organization. This control validates the `security defaults` setting for the Microsoft Entra ID tenant, which is the policy that this check targets.
Absent these defaults, users can sign in with password-only or via legacy protocols that bypass MFA, enabling password spray, replay, and phishing-based takeovers. Compromise risks data exposure (confidentiality), unauthorized changes (integrity), and service disruption (availability).
What this control checks
Checks the tenant's security defaults setting in Microsoft Entra ID
Audit evidence
Evidence that deployed resources meet this control: Prowler check entra_security_defaults_enabled (prowler azure --checks entra_security_defaults_enabled); PowerPipe control azure_compliance.control.ad_security_defaults_policy_enabled.
Framework-specific interpretation
ISO/IEC 27001:2022: Mapped to A.5.15 (Access Control).
NIS2 Directive (EU 2022/2555): Mapped to 2.3.1 (The relevant entities shall review independently their approach to managing network and information system security and...) and 3.1.3 (The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate...).
Framework mappings
The clauses this control is mapped to in each framework.
- A.5.15 Access control
- 2 Risk management policy
- 3 Incident handling
- 6.1.1 Ensure that 'security defaults' is enabled in Microsoft Entra ID
- 5.1.1 Ensure that 'security defaults' is enabled in Microsoft Entra ID
RBI Cyber Security Framework for UCBs
- Annex I (7.2)
- 1.1.1 Ensure Security Defaults is enabled on Azure Active Directory
- 1.1.1 Ensure Security Defaults is enabled on Microsoft Entra ID
- 2.1.1 Ensure Security Defaults is enabled on Microsoft Entra ID
- 164.312(d) Person or entity authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_security_defaults_policy_enabled - Powerpipe Control:
azure_compliance.control.ad_security_defaults_policy_enabled - Prowler Check:
entra_security_defaults_enabled
Last reviewed: 2026-10-09