Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Review Microsoft Entra security in this order: confirm that either Security Defaults or Conditional Access is enforcing a baseline; protect administrator sign-ins with multifactor authentication (MFA); audit privileged role assignments; reduce legacy protocol exposure; plan the retirement of legacy Identity Protection risk policies; then test and verify every change with report-only results and sign-in evidence.
There is no universal tenant configuration. Security Defaults are intended as a simpler baseline, while Conditional Access provides more granular control when the tenant has the relevant licensing. The safest review is a staged one: establish replacement protections before removing an existing baseline, enroll administrators before requiring new authentication methods, and validate application impact before blocking a protocol.
Start with a six-step review sequence
- Confirm the baseline: identify whether Security Defaults or Conditional Access currently governs the tenant.
- Protect sign-ins: require MFA for administrators first, then extend protection to users as the organization is ready.
- Audit privileged access: verify every administrator role, remove unnecessary assignments, and use time-limited elevation where the tenant supports it.
- Reduce protocol exposure: block legacy authentication where appropriate and identify dependencies on device-code flow.
- Update risk controls: migrate legacy Identity Protection user-risk and sign-in-risk policies before their stated October 1, 2026 retirement.
- Test and verify: use report-only policy results, policy-impact information, and sign-in logs before and after enforcement.
Work through the sections below in that order. A later control should not be used to compensate for an unverified baseline or an unprotected administrator account.
1. Confirm which baseline governs the tenant
Microsoft Entra tenants need an active protection baseline. The first question is not which individual toggle to change, but whether Security Defaults or Conditional Access is responsible for the tenant’s baseline behavior.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Security Defaults
Security Defaults are designed for organizations that want a straightforward baseline with limited customization. They are useful when the tenant does not need a large set of exceptions, application-specific rules, or detailed policy combinations. Their simplicity also means that they may not express every control an organization needs.
For a small or lightly customized tenant, this lower operational complexity can be valuable. Administrators still need to know what the baseline does, which identities it affects, and how recovery access is maintained. Simplicity is not a reason to skip enrollment, role review, or sign-in monitoring.
Conditional Access
Conditional Access supports more granular controls, but Microsoft requires the relevant licensing for the controls a tenant uses. It is the better fit when administrators must distinguish between users, applications, devices, locations, or risk conditions and apply different responses. The exact policy set still depends on the tenant’s licensing and operating requirements.
Recommended Free Tools
That flexibility brings more administration. Each policy needs an owner, a defined scope, exclusions that are justified, and a test plan. A tenant can combine controls for different populations, but every combination should be evaluated for unexpected interactions rather than assumed to behave like a single switch.
Security Defaults and Conditional Access cannot run together
Microsoft states that Security Defaults and Conditional Access cannot be enabled simultaneously. If an organization is moving to Conditional Access, it should first recreate the required baseline protections there and confirm that those replacement policies are ready. Do not turn off Security Defaults simply to begin experimenting with other policies; disabling the only active baseline can leave the tenant exposed.
Plan the transition as a change with a clear owner and rollback approach. Capture the current baseline, map each protection to a replacement policy, test those policies in report-only mode where available, and verify administrator recovery access before changing the setting that governs the tenant.
| Decision factor | Security Defaults | Conditional Access |
|---|---|---|
| Primary purpose | A simpler, broadly applied baseline | Granular policy control for licensed tenants |
| Customization | Limited customization by design | More detailed conditions and controls |
| Licensing | Microsoft’s Security Defaults guidance does not state an additional licensing requirement on the cited page | Requires the relevant licensing |
| Operational complexity | Lower administrative complexity | More planning, testing, and ongoing policy maintenance |
| Migration risk | Must remain in place until equivalent replacement protections are active | Requires recreating the baseline before Security Defaults are disabled |
Evidence to record during the baseline check
- Which baseline is enabled today.
- Whether any Conditional Access policies already exist and what they cover.
- Which licenses are assigned to the users and workloads that the proposed policies will evaluate.
- Which exclusions or emergency-access arrangements are documented.
- Whether a migration plan has a tested replacement before the current baseline is removed.
2. Protect administrator sign-ins with MFA before expanding to everyone
Microsoft’s guidance prioritizes MFA for administrator accounts, followed by broader user coverage. Start with the identities that can change authentication, permissions, applications, or recovery settings. A compromised administrator account can undo otherwise strong controls.
Decide whether administrators need phishing-resistant MFA
For administrator roles, review whether phishing-resistant MFA is appropriate for the tenant’s threat model and available methods. Microsoft identifies passkeys using FIDO2 as an option. A compatible physical security key can be used for this purpose, but buying a key is not automatically necessary for every organization; compatibility, enrollment capacity, recovery procedures, and the devices administrators use all matter.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before selecting a method, document which administrator roles must use it, which devices support enrollment, and how a replacement or lost authenticator will be handled. A method that is technically strong but unavailable during an incident is not a complete recovery design. The product cost of a physical key, if an organization chooses one, is only part of the operational decision; enrollment, spares, support, and recovery also require planning.
Register methods before enforcing them
Have administrators register the supported authentication methods before enabling a policy that requires those methods. Microsoft warns that enforcing a new requirement before registration can lock administrators out of the tenant. Establish a controlled enrollment window, verify that each administrator can complete a sign-in with the registered method, and document a recovery path before changing enforcement.
Test more than the normal sign-in. Confirm that an administrator can authenticate from the workstation and network used for emergency work, that another protected administrator can help with recovery, and that emergency access arrangements remain usable. Keep the enrollment list current when people change roles or leave the organization.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteExtend MFA to users in controlled stages
Once administrator coverage is working, extend MFA to the wider user population according to the organization’s applications, workforce patterns, and support capacity. Use report-only evaluation and sign-in evidence to identify users or applications that will fail before enforcement. A tenant can require different methods or apply different conditions, but those choices are policy decisions rather than a single universal setting.
Stage the rollout so support teams can respond to registration problems and application prompts. Include users who work through older clients, shared devices, or unusual sign-in paths in testing. Do not infer that successful administrator enrollment proves every user population is ready.
Interpret Microsoft’s 99.2% statement carefully
Microsoft’s Security Defaults documentation associates removal of the 14-day MFA registration grace period with protection against “over 99.2% of identity-based attacks.” The surfaced documentation does not state a study year or identify the underlying study, so treat this as Microsoft’s qualified documentation statement, not as an independently verified statistic or a promise about a particular tenant.
3. Review every privileged role assignment
After administrator authentication is protected, examine who has administrative roles and whether each assignment is still necessary. The objective is least privilege: each person receives only the access required for the job, for only as long as it is needed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Inventory and justify assignments
- List users and service identities with administrator roles.
- Confirm the business reason and owner for each assignment.
- Remove standing assignments that no longer match a person’s responsibilities.
- Separate daily work from tasks that require elevated permissions where the operating model allows it.
- Review role assignments again after organizational changes, not only during an annual audit.
Include delegated administrators and nonhuman identities in the inventory. For each entry, record the role, scope, owner, approval, and date of the next review. A role that is technically valid can still be excessive if the person no longer performs the associated task.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use time-limited elevation when the tenant supports it
Where licensing and operations support it, consider just-in-time activation instead of permanent administrator access. Time-limited activation reduces the period in which an account can be used with elevated privileges. Access reviews can provide a recurring confirmation that role membership remains justified. These controls add operational work, so define approvers, activation procedures, and an escalation path before enabling them.
Decide in advance who can approve an activation, how long it should last, and what happens when an urgent task exceeds the normal process. A time-limited model is effective only when administrators can activate it reliably and reviewers act on the resulting records.
Preserve emergency recovery access
Least privilege does not mean deleting every powerful account. Maintain documented emergency recovery access that is protected, monitored, and tested under controlled conditions. Ensure that an MFA rollout, a Conditional Access exclusion, or a role cleanup cannot remove the ability to recover the tenant when ordinary administrator accounts are unavailable.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep emergency access separate from routine administration and make its protection part of every policy test. The account should not become an unreviewed permanent exception; document its purpose, safeguards, monitoring, and test cadence.
4. Check legacy authentication and device-code exposure
Block legacy authentication where it is no longer required
Confirm whether older authentication protocols are still accepted and identify any applications, devices, or scripts that depend on them. Block legacy authentication where appropriate, but first validate the dependencies. An immediate block can interrupt a workload that has not yet been upgraded, so record the affected owner and migration plan before enforcement.
Do not treat an inventory made only from current user reports as complete. Check sign-in evidence and application ownership, then test the modern authentication path with representative accounts. If a dependency cannot be removed immediately, document the exception, its owner, and the date for another review rather than allowing an unnamed permanent bypass.
Inventory device-code flow dependencies
Device-code flow can be used by applications and devices that cannot display a normal sign-in experience. Treat it as a dependency to discover and test rather than assuming that every tenant can block it immediately.
Microsoft’s Security Defaults documentation states: “Starting July 1, 2026, all new Microsoft Entra tenants block device code flow as part of security defaults.” The statement applies to new tenants beginning on that date; it should not be generalized to every existing tenant without checking the tenant’s current behavior and policies.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Validate before tightening protocol controls
- Identify workloads that use legacy authentication or device-code flow.
- Ask each workload owner whether a modern authentication path is available.
- Test the replacement path with a representative account or device.
- Use report-only or equivalent evaluation where available to observe policy impact.
- Enforce the block after the dependency list and recovery plan are current.
Record the date of the protocol review and the evidence used. This makes it easier to distinguish a genuinely unused flow from one that simply has not appeared in a short observation period.
5. Replace legacy Identity Protection risk policies
Check whether the tenant still relies on the older Identity Protection user-risk or sign-in-risk policies. Microsoft states that these legacy policies retire on October 1, 2026. The date is time-sensitive, so organizations should schedule migration rather than waiting for a sign-in failure.
Plan the migration to Conditional Access
Map each legacy user-risk and sign-in-risk response to an equivalent Conditional Access design, then confirm that the tenant’s licenses support the resulting controls. Preserve the intended distinction between a risky user and a risky sign-in; do not assume that copying a policy name produces the same behavior.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Document the original condition, the intended grant or block response, remediation requirements, exclusions, and emergency-access treatment. This comparison exposes gaps before the old policy is removed and gives reviewers a concrete way to judge whether the replacement is equivalent for the tenant’s needs.
Test the resulting behavior
- Run the replacement policies in report-only mode first.
- Use representative accounts and sign-in scenarios to verify that the expected grant, block, or remediation action appears.
- Check exclusions, administrator recovery access, and application dependencies.
- Set an internal deadline ahead of October 1, 2026 so there is time to correct unexpected results.
Because Microsoft can update licensing requirements and policy behavior, confirm the current documentation and tenant eligibility when the migration is scheduled. Keep the old and new designs documented during the transition, but do not leave an unmaintained legacy policy as the only protection while the deadline approaches.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Test, enforce, and verify with evidence
Start in report-only mode
Use report-only mode to observe what a Conditional Access policy would do without immediately changing access. Combine that view with policy-impact information to find users, applications, devices, and sign-in paths that need remediation. Report-only results are a planning aid, not proof that every future sign-in will behave identically.
Test both expected and exceptional paths: a standard user, an administrator, a newly enrolled method, an application using a different protocol, and an emergency recovery account. Record the result for each path and resolve unexpected outcomes before moving to enforcement.
Review sign-in logs after a change
After enforcement, inspect sign-in logs and authentication details for both successful and failed attempts. Confirm which policy result applied, which authentication method was used, and whether the observed outcome matches the intended design. Keep an incident path ready so an affected user or workload can be restored without disabling the entire baseline.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Review evidence over enough time to include normal and less frequent workloads. Compare policy results with the scope and exclusions recorded in the change record. A successful test at one time or from one network does not establish that every sign-in path is healthy.
Understand the limits of sign-in evidence
Sign-in data can be incomplete at first, particularly immediately after a policy change. Allow time for records to appear and correlate multiple events before drawing conclusions. IP-based location is a best-effort estimate; a mapped location is not definitive proof of a user’s physical location. Do not use a single location result as the sole basis for an investigation or an access decision.
Use a change record for each policy
- Write down the policy purpose and the users, applications, and conditions in scope.
- Record the licensing assumption and any exclusions.
- Capture report-only findings and the fixes made before enforcement.
- Note the enforcement time and the sign-in evidence reviewed afterward.
- Assign an owner and a date for the next review.
How to choose the starting baseline
Choose Security Defaults when the organization needs a simpler baseline and can operate within its limited customization. Choose Conditional Access when the tenant has the relevant licensing and needs differentiated controls, risk-based decisions, or a more deliberate migration and testing process. In either case, keep one baseline active, protect administrators before broad rollout, and verify the effect of every change with sign-in evidence.
The practical comparison is not simply “basic versus advanced.” Weigh licensing, customization, operational complexity, and migration risk together. A licensed tenant may still prefer Security Defaults if it does not need exceptions; a tenant that needs application-, device-, location-, or risk-specific behavior may accept the additional administration of Conditional Access. Reassess the choice when business requirements or licensing change.
Common mistakes that create avoidable outages
- Disabling Security Defaults first: this removes the active baseline before replacement Conditional Access policies are ready.
- Enforcing phishing-resistant MFA before enrollment: administrators may be unable to sign in or complete recovery.
- Leaving excessive standing roles: permanent privileges increase the impact of a compromised account and make reviews harder.
- Blocking protocols without an application inventory: legacy clients or device-code workloads can fail unexpectedly.
- Waiting past the risk-policy retirement date: a legacy Identity Protection design may no longer be available when migration is finally attempted.
- Treating a report-only result or IP map as certainty: both are evidence for investigation, not guarantees about every sign-in or a person’s physical location.
- Assuming licensing without checking: a policy design can fail or be unavailable when the assigned licenses do not support the intended controls.
- Relying on one administrator or one recovery method: an outage, lost authenticator, or role change can make the tenant difficult to recover.
What completion looks like
A sound review leaves the tenant with one clearly identified baseline, MFA coverage that administrators can actually use, a justified and recoverable privileged-access model, documented protocol dependencies, a migration plan for retiring risk policies, and a test record showing what happened before and after enforcement. Revisit those decisions whenever licensing, applications, administrator roles, or Microsoft’s published behavior changes.
Frequently Asked Questions
Should I use Security Defaults or Conditional Access?
Use Security Defaults when you want a simpler baseline with limited customization. Use Conditional Access when the tenant has the relevant licensing and needs differentiated controls for users, applications, devices, locations, or risk. Do not enable both; recreate the required baseline in Conditional Access before disabling Security Defaults.
How do I require MFA for Microsoft Entra administrators?
Protect administrator accounts first, decide whether phishing-resistant MFA such as a FIDO2 passkey is appropriate, and have every administrator register the supported method before enforcement. Test normal and recovery sign-ins so a new requirement does not lock out the tenant.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow can I test a Conditional Access policy before turning it on?
Run the policy in report-only mode, review policy-impact information, and test representative users, administrators, applications, devices, and recovery paths. After enforcement, check sign-in logs and authentication details; allow for initially incomplete records and treat IP location as an estimate.
What should I do about legacy Identity Protection risk policies?
Map user-risk and sign-in-risk policies to Conditional Access, verify licensing, test the replacement in report-only mode, and migrate before Microsoft’s stated October 1, 2026 retirement date.
Do I need to buy a FIDO2 security key?
Not necessarily. Microsoft supports FIDO2 passkeys, and a compatible physical key is one option for phishing-resistant MFA. Decide based on compatibility, enrollment, recovery, device support, and operational needs rather than assuming a particular product is required.
The Bottom Line
Start with the active baseline, secure administrator sign-ins, then review privileged roles, protocol dependencies, and retiring risk policies. Keep replacement protections ready before switching baselines, enroll methods before enforcing them, and use report-only results plus sign-in evidence to validate every change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
