Back to Checks
azure

Microsoft Entra ID tenant has Security Defaults enabled

entra_security_defaults_enabled
Service: entraSeverity: critical
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra Security defaults provide tenant-wide baseline identity protections:

  • MFA registration and challenges
  • Legacy auth (IMAP/POP/SMTP) blocked
  • Extra checks for privileged access

This evaluation identifies whether that baseline is enabled at the tenant level.

Prowler logoProwlerprowler-provider-azure

Risk

Absent these defaults, users can sign in with password-only or via legacy protocols that bypass MFA, enabling password spray, replay, and phishing-based takeovers. Compromise risks data exposure (confidentiality), unauthorized changes (integrity), and service disruption (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks entra_security_defaults_enabled

Recommendation

Activate Security defaults or implement equivalent Conditional Access as defense in depth:

  • Require MFA for all identities
  • Block legacy authentication
  • Safeguard admin portals and APIs Apply least privilege and zero trust, and regularly review access patterns and break-glass exceptions to keep coverage complete.

Remediation

CLI

az rest --method PATCH --url https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy --body '{"isEnabled":true}'

Other

1Sign in to the Microsoft Entra admin center with a Conditional Access Administrator or Global Administrator account
2Go to Identity > Overview > Properties
3Click Manage security defaults
4Select Enabled and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.entra.entra_client import entra_client


class entra_security_defaults_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            tenant,
            security_default,
        ) in entra_client.security_default.items():
            report = Check_Report_Azure(
                metadata=self.metadata(), resource=security_default
            )
            report.subscription = f"Tenant: {tenant}"
            report.status = "FAIL"
            report.status_extended = "Entra security defaults is disabled."

            if getattr(security_default, "is_enabled", False):
                report.status = "PASS"
                report.status_extended = "Entra security defaults is enabled."

            findings.append(report)

        return findings

References