Secure Microsoft 365 sign-ins by requiring multifactor authentication (MFA), blocking legacy authentication, and choosing the right enforcement method for your tenant: security defaults for a simple fixed baseline, or Conditional Access for licensed, customizable policies. Before enforcing changes, confirm your licensing, test policy impact, protect administrators with phishing-resistant MFA, and keep emergency accounts able to recover access.
Choose security defaults or Conditional Access
First check your tenant’s current subscription and Microsoft Entra entitlement. Product bundles can change, so verify licensing rather than relying on a remembered plan name. Microsoft describes security defaults as a no-additional-license baseline; Conditional Access requires at least Microsoft Entra ID P1. Microsoft’s licensing guidance says Microsoft 365 Business Premium and E3 include P1, while E5 includes P2. P2 adds risk-based Conditional Access capabilities.
| Decision | Security defaults | Conditional Access |
|---|---|---|
| License | No Entra premium license is required for the defaults baseline, according to Microsoft. | At least Microsoft Entra ID P1 is required, according to Microsoft. |
| Customization | Fixed controls; enable or disable the baseline. | Customizable policy assignments and controls. |
| Suitable when | You need a basic baseline without granular exceptions. | You have P1 or P2 and need scoped or contextual policies. |
| Key operational concern | Customization is limited, and supported methods are constrained by the defaults behavior. | Mis-scoped or overlapping policies can produce unexpected access; check coverage and exclusions. |
Security defaults require MFA registration, require MFA for administrators, prompt users for MFA when necessary, block legacy authentication and device-code flow, and protect privileged activities. Their built-in approach is less adjustable. Conditional Access gives administrators more control, but that flexibility makes policy scope, exceptions, and validation important.
For Microsoft’s setup guidance, see Set up multifactor authentication for Microsoft 365 and Configure Security Defaults for Microsoft Entra ID.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Prepare the tenant before changing enforcement
Inventory sign-in paths before enabling or replacing controls. Identify clients or devices that still use legacy authentication, service dependencies, MFA registration readiness, and existing emergency-access accounts. Tell users what registration and sign-in changes to expect. Legacy clients and devices may stop working once legacy authentication is blocked; migrate those dependencies instead of weakening the baseline without an explicit risk decision.
- Confirm whether security defaults or Conditional Access policies are already active.
- Identify users and administrators who have not registered a supported MFA method.
- Find legacy authentication clients and service dependencies, then plan migration.
- Establish emergency-access accounts and verify their independent sign-in methods.
Enable security defaults when a fixed baseline fits
If you do not need granular policy controls and your tenant has no Entra P1/P2 entitlement, security defaults provide the straightforward baseline. Prepare users for registration and prompts, then enable the defaults in the Microsoft Entra admin center under Identity > Overview > Properties > Manage security defaults. Microsoft warns not to turn security defaults off unless you are switching to Conditional Access with Entra ID P1 or P2; do not disable their protections before replacement policies are ready.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
While using security defaults, Microsoft says users register through the Authenticator notification option. Users may also use OATH TOTP codes, but registration is through the notification option. Microsoft cautions against disabling available methods while defaults are active because doing so could lock the tenant out.
Replace defaults with Conditional Access safely
Security defaults and Conditional Access cannot be active at the same time. A switch is not simply turning defaults off: recreate their coverage with policies, account for justified exclusions, and only then expand or refine controls.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Confirm entitlement. Verify Microsoft Entra ID P1 or P2 in the tenant’s current subscription.
- Build replacement policies. Microsoft’s Conditional Access templates include policies for MFA for all users, MFA for administrators, blocking legacy authentication, and MFA for Azure management.
- Review scope and exceptions. Check users, resources, guests, synchronization accounts, and emergency accounts. Document why any special case is excluded.
- Turn off security defaults only when the replacement coverage is ready. Defaults and Conditional Access cannot run together.
- Validate policies in report-only mode. Review sign-in and policy impact, fix registration or compatibility gaps, then enable policies deliberately.
Microsoft says its Conditional Access templates start in report-only mode and advises testing and monitoring each policy before enabling it. See Conditional Access policy templates.
Scope the all-user MFA policy deliberately
Microsoft’s all-users policy guidance recommends assigning the policy to all users and all resources, with no app exclusions, and requiring MFA. Exclude emergency-access accounts from restrictive MFA policies that could prevent recovery. Consider directory synchronization accounts or guest handling where relevant, and record the reason for any exception.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
A policy that grants access after MFA for one group does not by itself deny access to users outside that group. If users outside the covered group must be blocked, create and validate a separate deny policy for the intended scope. Review all overlapping policies and sign-in results before enforcement. Microsoft’s guidance is at Require MFA for all users with Conditional Access.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Require stronger MFA for administrators
Microsoft recommends phishing-resistant MFA for administrator roles. Authentication strength determines which combinations of methods satisfy a Conditional Access policy; Microsoft lists built-in multifactor, passwordless MFA, and phishing-resistant MFA strengths. Select the strength and covered built-in roles to match the tenant’s configuration.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Before enforcing the administrator policy, ensure administrators have registered a supported method. Microsoft warns that requiring phishing-resistant authentication before registration risks locking the tenant out. FIDO2 passkeys are one supported path. Microsoft’s role-policy guidance is at Require phishing-resistant multifactor authentication for Microsoft Entra administrator roles.
Protect and test emergency-access accounts
Maintain at least two cloud-only emergency accounts, each protected with a phishing-resistant method such as FIDO2 passkeys or certificate-based authentication. Exclude them from enforced policies that could require an unavailable device or otherwise restrict sign-in. Monitor their use and test them regularly: Microsoft gives quarterly testing as an example and summarizes validation at least every 90 days. Follow Microsoft’s guidance at Manage emergency access admin accounts.
Account for method and workload limitations
- External authentication methods: Microsoft’s cited policy guidance says these are currently incompatible with authentication strengths. If using them, use the ordinary “Require multifactor authentication” grant control instead, and check current documentation because support can change.
- Per-user MFA: Microsoft describes it as a last option when security defaults or Conditional Access cannot be used.
- Service principals: User-scoped Conditional Access does not automatically cover service principals. Microsoft recommends workload-identity Conditional Access for them and replacing script or code credentials with managed identities where possible.
For Microsoft’s MFA licensing and consumption details, see Microsoft Entra multifactor authentication versions and consumption plans.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
