What security defaults does
Security defaults is a single setting in the Microsoft Entra admin centre. When it is on, every user must register for multi-factor authentication, administrators are asked for it every time they sign in, ordinary users are asked when Microsoft judges the sign-in to be risky or unusual, and legacy authentication methods that cannot do multi-factor are blocked. New tenants usually have it switched on from the start. Older tenants may have it off, often because someone disabled it years ago to get a scanner or app working and never turned it back on.
For a small business on a basic Microsoft 365 plan with no other sign-in controls, it is a strong baseline. It costs nothing and needs no design work. Its weakness is that it is all or nothing. You cannot exclude a scanner account, require stronger methods only for finance, or make exceptions for a particular situation without turning the whole thing off.
What Conditional Access does
Conditional Access is a set of if-then rules for sign-in. If a user is signing in to Microsoft 365 from outside New Zealand, block it. If someone is accessing the finance site from a personal device, allow it in the browser only. If an admin is signing in, require a phishing-resistant method such as a passkey. If the sign-in looks risky, ask for multi-factor again or block it.
That flexibility lets you match security to how your business actually works. A practice where clinicians use shared reception computers can set different rules from a firm where everyone has their own laptop. Conditional Access requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium and some other plans; check current licensing before you plan around it.
You use one or the other, not both
Security defaults and Conditional Access do not run side by side. To create Conditional Access policies you turn security defaults off, and from that moment your rules are the only thing standing between a stolen password and your data. Turning defaults off without immediately replacing them with equivalent policies is a common and dangerous mistake.
The safe order is to build your Conditional Access policies in report-only mode first, check the logs to see who they would have affected, then switch off security defaults and turn the policies on together. Microsoft provides policy templates that recreate the protections of security defaults, which make a good starting point to build from.
A sensible starter set of rules
Most small offices with Business Premium start with a short list: require multi-factor for all users, require phishing-resistant methods for admins, block legacy authentication, block sign-in from countries the business never operates in, and require devices to be managed or compliant before they can sync files. Each rule should have a clear name that explains its purpose.
Keep exclusions to a minimum and record why each one exists. Every business should also have one or two emergency access accounts excluded from the rules, with long random passwords stored securely and monitored for use, so that a mistake in a policy cannot lock every administrator out of the tenant.
Location rules and travel
Blocking overseas sign-ins is one of the most effective rules for NZ businesses, because so many attacks come from outside the country. It needs a process for staff who travel. Before a trip, an admin adds the person to a temporary travel group allowed from the destination, then removes them when they are home.
Be aware that location is worked out from the internet address, which is not always accurate. Some mobile networks and VPN services appear to be in Australia or further afield. Test with your own staff before enforcing, and watch the sign-in logs for the first couple of weeks to catch people who are blocked unexpectedly. Keep a short note of who was affected and why, because the same names tend to come up again.
Which should you choose?
If you are on a basic plan and nobody is actively managing your tenant, leave security defaults on. It is far better than a half-built set of rules nobody maintains. If you have Business Premium and someone who can design, test and review policies, Conditional Access gives you stronger protection that fits how your staff actually work.
Whichever you use, check it is really in effect. Plenty of small tenants have security defaults turned off, no Conditional Access policies and multi-factor only on some accounts, usually because something broke years ago and the protection was disabled to fix it. Five minutes in the Entra admin centre will tell you which state you are in.
In short
- Security defaults is free and forces multi-factor for everyone.
- Conditional Access lets you write rules but needs Entra ID P1.
- Never turn off security defaults without rules ready to replace it.
- Test policies in report-only mode before enforcing them.
- Keep emergency access accounts outside the rules and monitored.