Overview and What You Will Learn
In this lab, you will enable Security Defaults for baseline MFA protection, then configure a more targeted Conditional Access policy that requires MFA specifically when a login attempt comes from outside a trusted location - seeing the difference between blanket protection and risk-based, targeted protection.
Why This Matters in Production
At a trading platform like Zerodha, a compromised account without MFA enforced can mean an attacker walks straight into production systems with a single stolen password. Microsoft's own security research consistently shows MFA blocks the overwhelming majority of account compromise attempts, even when the attacker already has a valid password in hand.
Core Principles
Azure AD offers two levels of MFA enforcement, and understanding the difference matters for choosing the right one for your organization's actual needs.
+------------------------------------------+| Security Defaults || One toggle, applies broadly || Enforces MFA for administrators || Blocks legacy authentication protocols || No per-user or per-condition configuration |+------------------------------------------+| Conditional Access (Premium feature) || Granular, condition-based policies || "Require MFA only when login comes from an || unfamiliar country" or similar targeted rules|| Requires Azure AD Premium licensing |+------------------------------------------+Security Defaults is the fastest path to baseline protection with zero configuration. Conditional Access is the tool for applying MFA selectively, based on real risk signals, once your organization's needs outgrow a single blanket setting.
Detailed Step-by-Step Practical Lab
- Check the current Security Defaults status for your tenant:
az rest --method get \ --uri "https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy"- If Security Defaults is not yet enabled, enable it - this is normally done through the Portal since it is a tenant-wide policy setting:
Portal: Azure Active Directory -> Properties -> Manage Security Defaults -> Yes -> Save- Confirm the setting was applied by re-checking the policy status:
az rest --method get \ --uri "https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy" \ --query "isEnabled" --output tsv- For organizations with Azure AD Premium, create a Conditional Access policy requiring MFA only for logins from outside a trusted named location:
Portal: Azure AD -> Security -> Conditional Access -> New Policy Name: Require MFA outside trusted locations Users: All users (or a specific group for a staged rollout) Cloud apps: All cloud apps Conditions: Locations -> Include: Any location Exclude: your defined trusted named locations Grant: Require multi-factor authentication Enable policy: On (start with Report-only mode first)NoteAlways start a new Conditional Access policy in Report-only mode. This lets you see exactly which sign-ins would have been affected by the policy without actually enforcing it yet - catching a policy logic error before it locks out legitimate users.
After reviewing Report-only results and confirming the policy behaves as expected, switch it from Report-only to On.
Verify the policy is active by listing your Conditional Access policies:
az rest --method get \ --uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies"Production Best Practices & Common Pitfalls
SecurityNever disable MFA entirely to "simplify things" for a group of users experiencing friction. Narrow its application scope with Conditional Access instead of removing the protection outright - the goal is reducing unnecessary friction for low-risk logins, not removing protection for everyone.
TipAlways test a new Conditional Access policy in Report-only mode first, and consider rolling it out to a small pilot group before applying it to every user in the organization. A policy with a logic error enforced immediately, tenant-wide, can lock out a large number of legitimate users at once.
- Security Defaults and Conditional Access are not both required simultaneously - Conditional Access policies typically replace the need for Security Defaults once your organization has Azure AD Premium and more specific requirements than the blanket toggle provides.
- Exclude at least one emergency access (break-glass) account from any Conditional Access policy that could lock out administrators. A policy misconfiguration that locks out every admin account simultaneously is a genuinely difficult situation to recover from without a pre-planned exception.
Quick Reference & Troubleshooting Commands
| Command | Description |
|---|---|
az rest --method get --uri ".../identitySecurityDefaultsEnforcementPolicy" |
Check Security Defaults status |
az rest --method get --uri ".../conditionalAccess/policies" |
List Conditional Access policies |
az ad user list |
List users a policy might apply to |
az ad group member list |
Check group membership for a targeted rollout |