Your IT Consultant

Information Technology Blog
by John W. Simek, Vice President of Sensei Enterprises, Inc.

New Microsoft Security Defaults

June 22, 2021

Security should be top of mind for all of us these days, especially given the significant increase in cyber attacks. One of the fastest, cheapest and most effective steps we can take is to enable multi-factor authentication (MFA). For some reason, users are slow and/or reluctant to configure their accounts with MFA. As a result, some companies (Ring, Google, etc.) are enabling MFA by default. You can now add Microsoft to that list.

Microsoft is slowly rolling out new security defaults to new users. Microsoft described how it is helping protect users from attacks using preconfiguring security settings in a posted document. The preconfigured security settings include:

  • Requiring all users to register for Azure AD Multi-Factor Authentication.
  • Requiring administrators to perform multi-factor authentication.
  • Blocking legacy authentication protocols.
  • Requiring users to perform multi-factor authentication when necessary.
  • Protecting privileged activities like access to the Azure portal.

If your account was created after October 22, 2019, the security defaults may already be in place for you. Security defaults are now enabled for all new tenants. Users will now have MFA enabled by default according to the post.

“All users in your tenant must register for multi-factor authentication (MFA) in the form of the Azure AD Multi-Factor Authentication. Users have 14 days to register for Azure AD Multi-Factor Authentication by using the Microsoft Authenticator app. After the 14 days have passed, the user won’t be able to sign in until registration is completed. A user’s 14-day period begins after their first successful interactive sign-in after enabling security defaults.”

Besides MFA, the other defaults go a long way to increase protections. Previously, I mentioned recent BEC attacks attempting to bypass MFA for Microsoft 365 accounts using legacy protocols. Notice that blocking those legacy protocols is part of the security defaults.

Hat tip to our friend and colleague, Ben Schorr, for bringing this good news to our attention. It’s nice to have a friend at Microsoft.

Email:  Phone: 703.359.0700
Digital Forensics/Cybersecurity/Information Technology
https://www.linkedin.com/in/johnsimek
https://amazon.com/author/johnsimek
https://senseient.com