Security defaults or conditional access must be enabled

Critical Azure General tenantsecurity-security-defaults-conditional-acces

Applies to

Microsoft.Graph/tenantSecurity

What CGPulse checks

A resource passes this rule when securityDefaults.isEnabled must equal true OR conditionalAccess.hasEnabledPolicies must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable Security defaults or configure Conditional Access to protect against phishing and password spray. In Azure Portal: Entra ID > Properties > enable Security defaults. See: https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults

Careful: Enabling security defaults enforces MFA for all users. Users without MFA registration will be blocked. Incompatible with conditional access policies

CLI

az rest --method patch --url https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy --body '{"isEnabled": true}'

Terraform

# Entra ID configuration - use AzureAD provider
# resource "azuread_conditional_access_policy" "example" {
#   display_name = "Require MFA for all users"
#   state        = "enabled"
#   conditions { ... }
#   grant_controls { built_in_controls = ["mfa"] }
# }

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan