So lets talk about “Security Defaults” a bit, this new feature in AzureAD who replaces “Baseline policies: ” in the Conditional Access pane within Security in AzureAD.
First of all – the baseline policies where in preview and could be changed before the feature went GA so we cant blame anyone of the service changing before production.
The Baseline policies gave us remediaton of MFA and and blocking of legacy authentication within 4 policies that everyone could use within Conditional Access, these four policies where free so no cost and that sweet!
- Baseline Policy: Require MFA for admins (Preview)
- Enabled MFA to all administrator roles within AzureAD
- Baseline Policy: End user protection (Preview)
- Enabled MFA registration to all users and required MFA for users with leaked password or other risky signins.
- Baseline Policy: Require MFA for Service Management (Preview)
- Require MFA for accessing the Azure Portal, Azure PowerShell modules or Azure CLI
- Baseline Policy: Block legacy authentication (Preview)
- Blocked the usage of legacy authentication on all services (such as pop, IMAP, native android clients etc.
For a good time now we cound enabled one or more of those 4 baseline rules – but that ends! At February 29th 2020 Microsoft will discontinue the use of Baseline policies so if you are using some of them you need to enable Security Defaults in AzureAD.
Head into portal.azure.com -> Properties -> Security Defaults and enable it.
Please not that if you have license for using Conditional Access (Azure AD Premium P1) you cannot a Conditional Accessrule without disabling Security Defaults.
And if you have Azure AD Premium P1 you should be creating the Conditional Access rules manually and that gived you several advantages such as exclude users, pinpoint to some cloud apps or exclude them and set other requiremets aswel.
Best practice says that you should always have a “Break the glass administrator” account who is excluded from all the Requirements – but please note! That account need to be monitored and high security alerts should be raised every time the account is used.
