Microsoft Entra tenant with security defaults not enabled

This condition enables an attacker to use previously obtained credentials for legacy authentication, bypassing additional authentication requirements and allowing unauthorized access to resources. The lack of multi-factor authentication and conditional access policy enforcement creates a vulnerability that can be exploited by attackers.

An attacker can exploit this condition by using previously obtained credentials to log in via legacy authentication protocols, thereby circumventing conditional access policies and gaining unauthorized access to resources without additional authentication requirements. This allows the attacker to maintain persistence and potentially escalate privileges.

Cayosoft Guardian monitors the configuration of security defaults in your Microsoft Entra tenant, detecting when security defaults are disabled and flagging this as a security issue for administrators to address.

Cayosoft Guardian alerts administrators to enable security defaults in the Microsoft Entra admin center, which blocks legacy authentication and enforces additional authentication requirements for conditional access policies, thereby limiting unauthorized access. This helps provide visibility into potential attack paths and supports investigation and response efforts.