A no-cost set of baseline protections applied across the whole tenant: everyone must register for MFA and legacy authentication is blocked. It cannot be targeted at particular groups.
Read more: Microsoft Learn
In the Ultra Transcenders books
AZ-305SC-500AZ-900SC-900AB-900SC-300
Each book explains Security defaults in context, with comparison tables and the common traps.
Terms in this definition
- Set
Secret permission in Key Vault for writing secrets; some older material refers to it as Create.
- Baseline
A formally reviewed and approved specification that may afterwards be altered only under formal change control. The word also describes the architecture as it stands today.
- Tenant
A trusted, dedicated Microsoft Entra ID instance that stores the users, groups and app registrations of one organisation. A subscription trusts only a single tenant, although a tenant can be trusted by several subscriptions.
- MFA
Multifactor authentication: asking for another factor on top of a password at sign-in, usually required by a Conditional Access grant control.
- Legacy authentication
Older protocols, such as Exchange ActiveSync and legacy mail apps (the Other clients category), that sign in with basic authentication. MFA isn't possible with them, so Conditional Access policies use the client apps condition to block them.