Demystifying Microsoft 365 MFA: Security Defaults & Conditional Access

MFA vs Security Defaults vs Conditional Access

Which security is right for your business?

We all agree that you must make your Microsoft 365 secure with multi-factor authentication. But there are three different options for your business on how to implement MFA - and we're going to be talking about these in today's video.

So, the three ways to implement MFA are

1. Per user
2. Security defaults
3. Conditional Access

------------------------------------------------------------------------------------------------------------------------------------------------
Are you using Microsoft 365 to its fullest potential? Are you getting the most from your investment? It's time to supercharge your Microsoft 365 and your business.

Our FREE Guide - Discover 5 things in Microsoft 365 that will save your business time and money….. and one feature that increases your Cyber Security by 99.9%

------------------------------------------------------------------------------------------------------------------------------------------------

--------
So who am I and what do I do?

I am an IT expert with over 20 years of industry experience across a multitude of different areas. I am the Founder & Managing Director of Integral IT. Our mission is to deliver IT services that bring real value to each and every one of our customers, no matter how big or small.

If you need IT support, we can help. We can help you wherever you are in the world; you just need an internet connection.

-- Make Sure To Follow Me On My Socials Below --

If you have any video ideas, or if you'd like me to make a video on anything specific make sure to let me know in the comments below!

00:00 Introduction
01:01 Per User MFA
01:36 Security Defaults
02:31 Conditional Access
04:10 How to Configure MFA
06:41 How to Configure Security Defaults
07:22 How to Configure Conditional Access

[networkn]

Enjoyed this. What is frustrating is that some parts of 365 can show MFA not configured, but it IS configured, under Conditional Access.

[davidadams]

Security Defaults mandates that normal users must *setup* MFA (within 14 days) but *does not* mandate its use, except when the system determines the sign-in as 'risky' e.g. last sign-in was from UK, then suddenly the next is from Africa, or if the user is resetting their own password. Security Defaults mandates MFA registration *and use* for all administrative roles e.g. Global Admin, User Admin etc. Google 'Security defaults in Microsoft Entra ID' for further info. I think this is a nice balance between security and user convenience, imho.

[James-sclz]

Enforced means the user has completed the MFA registration. Enabled means they have not and have 14 days by default or will be forced. I’d you don’t want MFA you simply don’t click enable MFA. You should never click enforce unless they have previously registered according to MS. Good video

[GoreGamer]

You and Andy are my Hero's!!!! This video is absolutely amazing, and I'm actively implementing the strategies outlined here. However, I'm facing a challenge in my environment. Somehow, the 'Verify by Phone' feature got activated for my users. We're planning a full rollout in the 2nd or 3rd week of January, and I need this phone verification feature turned off temporarily until we complete our user migration. My plan is to enable all multi-factor authentication (MFA) and phone verification after 90+ days post-migration. Any advice on how to manage this would be greatly appreciated!

[theoyiorkas]

If only the administrator has the Premium license and has set Conditional Access, then the regular users who have Basic or Standard license, what policy do they follow?

[SilesianWarrior]

I've enabled MFA for half my users using per user method. If i was to enable it now for everyone, via defaults, will the previous, already enrolled users be affected as well? I'd love to get 50% less phone calls about forgotten passwords during deployment.