SOLVED
Home

Transition from baseline policies to security defaults

%3CLINGO-SUB%20id%3D%22lingo-sub-1132413%22%20slang%3D%22en-US%22%3ETransition%20from%20baseline%20policies%20to%20security%20defaults%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1132413%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EHi%20team%2C%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%3EAny%20action%20required%20from%20all%20end%20users%26nbsp%3B%20or%20affect%20to%20them%20if%20we%20we%20transition%20to%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3Esecurity%20defaults%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%3Ein%20Office%20365%20admin%3F%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSTRONG%3ENote%3C%2FSTRONG%3E%3CSPAN%3E%3B%20currently%20we%20are%20uses%20baseline%20policies%20and%20all%20users%20is%20already%20apply%20MFA%20using%20text%20code%20%26amp%3B%20Microsoft%20Authentication%20app.%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%3ERegards%2C%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3EVichet%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1132413%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Emfa%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1132590%22%20slang%3D%22en-US%22%3ERe%3A%20Transition%20from%20baseline%20policies%20to%20security%20defaults%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1132590%22%20slang%3D%22en-US%22%3E%3CP%3EWell%20for%20starters%2C%20SMS%2Ftext%20is%20not%20an%20available%20method%20with%20security%20defaults%20in%20place.%20Read%20the%20documentation%20for%20all%20the%20other%20differences%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Ffundamentals%2Fconcept-fundamentals-security-defaults%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Ffundamentals%2Fconcept-fundamentals-security-defaults%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1132835%22%20slang%3D%22en-US%22%3ERe%3A%20Transition%20from%20baseline%20policies%20to%20security%20defaults%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1132835%22%20slang%3D%22en-US%22%3EI%20found%20that%20this%20is%20not%20true%20however.%20You%20need%20to%20register%20with%20the%20app%2C%20but%20after%20that%20you%20can%20go%20back%20to%20aka.ms%2Fmfasetup%20and%20register%20all%20the%20other%20methods%2C%20and%20they%20also%20work%20just%20fine.%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1147525%22%20slang%3D%22en-US%22%3ERe%3A%20Transition%20from%20baseline%20policies%20to%20security%20defaults%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1147525%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%3CBR%20%2F%3E%3CBR%20%2F%3ESince%20Security%20Default%20are%20block%20legacy%20authentication%20protocol%20for%20whole%20tenant.%20If%20some%20of%20users%20required%20this%20protocol%20such%20as%20IMAP%20for%20some%20use-case%2C%20How%20do%20we%20exclude%20it%3F%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%20for%20help.%3CBR%20%2F%3ERegards%2C%3CBR%20%2F%3E%26nbsp%3B%20%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1147526%22%20slang%3D%22en-US%22%3ERe%3A%20Transition%20from%20baseline%20policies%20to%20security%20defaults%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1147526%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F110212%22%20target%3D%22_blank%22%3E%40Vichet%20SIM%3C%2FA%3E%26nbsp%3Byou%20can't%2C%20you%20would%20need%20to%20use%20conditional%20access%20instead%20and%20build%20some%20policies.%20But%20that%20would%20require%20AAD%20premium.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1147529%22%20slang%3D%22en-US%22%3ERe%3A%20Transition%20from%20baseline%20policies%20to%20security%20defaults%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1147529%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F431307%22%20target%3D%22_blank%22%3E%40CloudHal%3C%2FA%3E%26nbsp%3Bthanks%20you.%20Can%20you%20provide%20some%20tip%20how%26nbsp%3B%3CSPAN%3Ebuild%20some%20policies%20in%26nbsp%3Bconditional%20access.%20We%20will%20go%20through%20to%20AAD%20premium%20to%20fix%20the%20issue.%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%2C%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1147535%22%20slang%3D%22en-US%22%3ERe%3A%20Transition%20from%20baseline%20policies%20to%20security%20defaults%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1147535%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F110212%22%20target%3D%22_blank%22%3E%40Vichet%20SIM%3C%2FA%3E%26nbsp%3BYes%2C%20h%3CSPAN%3Eighly%20recommend%20starting%20with%20Alex%E2%80%99s%20spreadsheet%20here%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fwww.itpromentor.com%2Fconditional-access-for-the-smb-a-how-to-guide%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20nofollow%20ugc%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.itpromentor.com%2Fconditional-access-for-the-smb-a-how-to-guide%2F%3C%2FA%3E%3CSPAN%3E%26nbsp%3BUse%20his%20spreadsheet%20and%20customise%20it%20to%20your%20needs.%20Makes%20it%20far%20easier%20to%20design%20them%2C%20and%20is%20also%20a%20good%20starting%20point.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1147561%22%20slang%3D%22en-US%22%3ERe%3A%20Transition%20from%20baseline%20policies%20to%20security%20defaults%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1147561%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20you%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F431307%22%20target%3D%22_blank%22%3E%40CloudHal%3C%2FA%3E%26nbsp%3Bfor%20the%20advise%2C%20I%20will%20check%20it%20for%20more.%20Any%20ways%20how%20%3CSTRONG%3Emodern%20auth%3C%2FSTRONG%3E%20from%20Default%20Security%20can%20help%20for%20this%20required!%20I%20thinks%20it%20might%20related%20to%20this%20topic%2C%20but%20not%20sure%20how%20to%20deploy%20and%20move%20to%20modern%20auth%20in%20%3CSTRONG%3ESecurity%20Default%3C%2FSTRONG%3E.%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%2C%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Vichet SIM
New Contributor

Hi team,

Any action required from all end users  or affect to them if we we transition to security defaults in Office 365 admin?
Note; currently we are uses baseline policies and all users is already apply MFA using text code & Microsoft Authentication app.

Regards,
Vichet

7 Replies
Highlighted

Well for starters, SMS/text is not an available method with security defaults in place. Read the documentation for all the other differences: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-d...

Highlighted
I found that this is not true however. You need to register with the app, but after that you can go back to aka.ms/mfasetup and register all the other methods, and they also work just fine.
Highlighted

Hi All,

Since Security Default are block legacy authentication protocol for whole tenant. If some of users required this protocol such as IMAP for some use-case, How do we exclude it?

Thanks for help.
Regards,
   

Highlighted

@Vichet SIM you can't, you would need to use conditional access instead and build some policies. But that would require AAD premium.

Highlighted

@CloudHal thanks you. Can you provide some tip how build some policies in conditional access. We will go through to AAD premium to fix the issue.

Regards,

Highlighted
Solution

@Vichet SIM Yes, highly recommend starting with Alex’s spreadsheet here https://www.itpromentor.com/conditional-access-for-the-smb-a-how-to-guide/ Use his spreadsheet and customise it to your needs. Makes it far easier to design them, and is also a good starting point.

Highlighted

Thanks you @CloudHal for the advise, I will check it for more. Any ways how modern auth from Default Security can help for this required! I thinks it might related to this topic, but not sure how to deploy and move to modern auth in Security Default.

Regards,