Skip to main content

lacework-global-513

1.1.1 Ensure Security Defaults is enabled on Azure Active Directory (Manual)​

Profile Applicability​

• Level 1

Description​

Security defaults in Azure Active Directory (Azure AD) make it easier to be secure and help protect your organization. Security defaults contain preconfigured security settings for common attacks.

Microsoft is making security defaults available to everyone. The goal is to ensure that all organizations have a basic level of security enabled at no extra cost. You may turn on security defaults in the Azure portal.

Rationale​

Security defaults provide secure default settings that we manage on behalf of organizations to keep customers safe until they are ready to manage their own identity security settings.

For example, doing the following:

  • Requiring all users and admins to register for MFA.
  • Challenging users with MFA - mostly when they show up on a new device or app, but more often for critical roles and tasks.
  • Disabling authentication from legacy authentication clients, which can’t do MFA.

Impact​

Enabling security defaults may negatively impact the functionality of other Microsoft services, such as MS365. This recommendation should be implemented initially and then may be overridden by other service/product specific CIS Benchmarks.

Audit​

From Azure Portal​

To ensure security defaults is enabled in your directory:

  1. From Azure Home select the Portal Menu.
  2. Browse to Azure Active Directory > Properties.
  3. Select Manage security defaults.
  4. Verify the Enable security defaults toggle is Yes.

Please note that at this point of time, there is no Azure CLI or other API commands available to programmatically conduct security assessment for this recommendation.

Remediation​

From Azure Portal​

To enable security defaults in your directory:

  1. From Azure Home select the Portal Menu.
  2. Browse to Azure Active Directory > Properties
  3. Select Manage security defaults
  4. Set the Enable security defaults toggle to Yes
  5. Select Save

Please note that at this point of time, there is no Azure CLI or other API commands available to programmatically conduct security configuration for this recommendation.

References​

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults
https://techcommunity.microsoft.com/t5/azure-active-directory-identity/introducing-security-defaults/ba-p/1061414
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-2-protect-identity-and-authentication-systems

Additional Information​

The setting in this recommendation are different in the Microsoft 365 Benchmark. This is because the potential impact associated with disabling of Security Defaults is dependent upon the security settings implemented in the environment. It is recommended that organizations disabling Security Defaults plan to implement equivalent settings to replace the settings configured by Security Defaults.