MT.1021: Security Defaults are enabled.
| ID | MT.1021 |
| Severity | High |
| Suite | Mito |
| Product | Entra ID |
| Feature | User and directory settings |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:IA-2(1) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged Accountsnist-800-53-r5:IA-2(2) Identification and Authentication (Organizational Users) | Multi-factor Authentication to Non-privileged Accounts |
| MITRE ATT&CK | T1078.004, T1110 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Security Defaults should be enabled in tenants that are not licensed for Entra ID Premium.
Security Defaults provide a baseline of identity protection, including multifactor authentication registration and enforcement and blocking of legacy authentication, for tenants that cannot use Conditional Access. Tenants with an Entra ID P1 or P2 licence are skipped, because they should configure Conditional Access policies instead.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
- Browse to Entra ID > Overview > Properties.
- Select Manage security defaults.
- Set Security defaults to Enabled and select Save.
Related links
Section titled “Related links”Mito check. Author: f-bader; contributors: weyCC81. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.