Microsoft Entra ID Defaults: A Risk MSPs Should Not Overlook
Many Microsoft 365 tenants may seem secure, but most rely on default Entra ID settings.
The following lab demonstrates this risk in a real tenant with default Entra ID settings.
For engineers asking how this works technically.
By default, Microsoft Entra ID prioritizes usability over security. (Singh, 2026)
What MSPs Commonly Inherit
In unconfigured tenants, we consistently find:
- No Conditional Access policies enforcing MFA
- Legacy authentication is not explicitly blocked.
- Identity Protection policies disabled
- Broad guest access with minimal restrictions (What’s new in Microsoft Entra – June 2025, 2025)
These are not mistakes; they are unvalidated defaults.
Attackers target these conditions because they reduce the effort needed to compromise accounts. (Security guidance - Protect identities and secrets - Microsoft Entra | Microsoft Learn, 2024)
Why This Matters for MSP Owners
Identity incidents rarely start with malware. (Identity-Based Cyber Attacks, 2024)
They start with:
- Password reuse
- MFA gaps
- Legacy protocols
- Unrestricted guest access
When these gaps exist, clients are affected, but the MSP remains responsible for remediation. Explicitly enforced, they cannot be defended. (Configure Security Defaults for Microsoft Entra ID, 2024)
The MSP Responsibility
Modern MSPs should not assume that Microsoft will address all security concerns. (Partner security requirements - Partner Center | Microsoft Learn, 2024)Every new or inherited tenant should include:
- Documented MFA enforcement
- Legacy authentication blocks
- Risk-based Identity Protection responses
- Guest-specific access controls
These are essential identity controls, not advanced security measures. (Azure Identity Management and Access Control Security Best Practices, 2026)
Final Thought
Strong identity security depends on what is actually enforced, not on adding more tools.
Need help validating this in your tenant?
This risk exists in most Microsoft 365 tenants.
References
Singh, J. (2026). Default Microsoft Entra ID Security Is Often Overestimated. ITBlogs.ca. https://www.itblogs.ca/blog/itblogsca-1/default-microsoft-entra-id-security-is-often-overestimated-36
(May 31, 2025). What’s new in Microsoft Entra – June 2025. Microsoft Community Hub. https://techcommunity.microsoft.com/blog/microsoft-entra-blog/what%E2%80%99s-new-in-microsoft-entra-%E2%80%93-june-2025/4352579
(2024). Security guidance - Protect identities and secrets - Microsoft Entra | Microsoft Learn. Microsoft Learn. https://learn.microsoft.com/en-us/entra/fundamentals/zero-trust-protect-identities
(December 31, 2023). Identity-Based Cyber Attacks. Red Sky Alliance. https://redskyalliance.org/xindustry/identity-based-cyber-attacks
(2024). Configure Security Defaults for Microsoft Entra ID. Microsoft Entra | Microsoft Learn. https://learn.microsoft.com/th-th/entra/fundamentals/security-defaults
(2024). Partner security requirements - Partner Center | Microsoft Learn. Microsoft Learn. https://learn.microsoft.com/en-us/partner-center/security/partner-security-requirements
(2026). Azure Identity Management and Access Control Security Best Practices. Microsoft Learn. https://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices