Choosing an MFA Strategy in Microsoft 365: Conditional Access vs. Security Defaults

The MFA Decision: Granular Control vs. Global Defaults

When securing a Microsoft 365 tenant, the primary challenge is balancing security strength with user friction. The critical decision is whether to use Security Defaults—a one-size-fits-all set of basic protections—or Conditional Access (CA), which allows you to define specific requirements based on the user, location, or device state.

The primary takeaway: Use Security Defaults for small organizations with no complex requirements. Use Conditional Access for any environment requiring exceptions (e.g., trusted office IPs), specific app exclusions, or compliance-based access.

Comparison of MFA Implementation Options

Feature	Security Defaults	Conditional Access (CA)	Legacy Per-User MFA
Licensing	Free / Included	Microsoft Entra ID P1/P2	Free / Included
Granularity	All users, all apps	User/Group/App specific	Per-user toggle
Location Awareness	None	Trusted IP ranges supported	None
MFA Methods	Microsoft Authenticator	Customizable (App, FIDO2, SMS)	Customizable
Management	Single On/Off switch	Policy-based engine	Manual per-user setup

Trade-offs and Constraints

Security Defaults are the fastest way to eliminate the risk of password-only attacks. However, they lack flexibility. If a specific legacy application cannot handle MFA prompts, or if you want to exempt your headquarters' static IP to reduce MFA fatigue, Security Defaults cannot accommodate these needs.

Conditional Access provides a "Zero Trust" framework. You can require MFA only when a user is signing in from an unfamiliar country or a non-compliant device. The trade-off is the licensing cost (Entra ID P1 or higher) and the increased risk of administrative lockout if a policy is misconfigured without an "Emergency Access" account.

Legacy Per-User MFA is largely deprecated in favor of the other two methods. It is difficult to audit and manage at scale, and it does not support the modern signal-based logic of Conditional Access.

Implementation: Creating a Targeted MFA Policy

To implement a professional MFA strategy, avoid "All Users" policies initially. Instead, use a pilot group to validate the flow. This example describes a policy that requires MFA for all users unless they are connecting from a known corporate network.

Configuration Steps (Microsoft Entra Admin Center)

1. Define Named Locations: Navigate to Protection > Conditional Access > Named locations. Add your corporate public IP ranges and mark them as "Trusted location."
2. Create Policy: Go to Policies > New policy.
3. Assignments:
   • Users: Select a pilot group (e.g., "IT-Test-Group").
   • Target resources: Select "All cloud apps."
   • Conditions: Under Locations, configure it to Include: Any location and Exclude: Selected locations (your Trusted location).
4. Access Controls: Under Grant, select "Require multi-factor authentication."
5. Enablement: Set the policy to "Report-only" first to analyze the impact in the logs before switching to "On."

Validation and Diagnostics

To verify the policy is working without guessing, use the Sign-in logs in the Entra ID portal. This is the only authoritative source for why a user was prompted (or not prompted) for MFA.

• Check: Filter logs by the test user. Click on the sign-in attempt and select the Conditional Access tab.
• Expected Result: For a sign-in from home, the policy should show Result: Success. For a sign-in from the office, it should show Result: Not Applied (due to the location exclusion).
• Risk: If you see Result: Failure, the user is blocked entirely. Ensure you have a "Break Glass" account excluded from all CA policies to regain access.

Rollback Procedure

If a Conditional Access policy causes widespread lockout:

1. Sign in using a global administrator account that was explicitly excluded from the policy.
2. Navigate to Conditional Access > Policies.
3. Change the policy state from "On" to "Off" or "Report-only."
4. Wait 5–10 minutes for the change to propagate across the Microsoft 365 global infrastructure.