When security defaults are enabled, what is enabled for all Azure AD users?

When security defaults are enabled in Azure Active Directory (Azure AD), it specifically involves the automatic enforcement of multi-factor authentication (MFA) for all users. This means that every user will be required to provide additional verification beyond just their password when accessing Azure services. This extra layer of security is crucial in protecting against unauthorized access and is part of Microsoft's approach to enhance security for all users by default.

Security defaults allow organizations to maintain a baseline level of security without requiring extensive configuration. By enabling MFA, organizations significantly reduce the likelihood of compromised accounts, as an attacker would need more than just a user's password to gain access.

While Azure AD Identity Protection, Azure AD Privileged Identity Management (PIM), and password complexity requirements are all important aspects of security, they are not automatically activated under security defaults. Instead, these features require specific licensing or configuration beyond the basic security defaults, which focuses primarily on ensuring all users have MFA enabled.