MT.1021 - Security Defaults are enabled.

Contributed by Fabian Bader with Stefan WeyAll contributors →

Overview

Security Defaults should be enabled in tenants that are not licensed for Entra ID Premium.

Security Defaults provide a baseline of identity protection, including multifactor authentication registration and enforcement and blocking of legacy authentication, for tenants that cannot use Conditional Access. Tenants with an Entra ID P1 or P2 licence are skipped, because they should configure Conditional Access policies instead.

Remediation action

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Entra ID > Overview > Properties.
3. Select Manage security defaults.
4. Set Security defaults to Enabled and select Save.

Related links

• Security defaults in Microsoft Entra ID - Microsoft Learn

Test Metadata

Field	Value
Test ID	MT.1021
Severity	High
Suite	Maester
Product	Entra ID
Feature	User and directory settings
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts, T1110 Brute Force
Supports controls	nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)
PowerShell test	Test-MtCheckMT1021
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1021.ps1
• Documentation: tests/maester/entra/Test.MT.1021.md