r/msp • u/icq-was-the-goat • 2d ago
Technical Microsoft Entra Security Defaults Getting Granular Controls (Private Preview)
Looks like Microsoft has updated Security Defaults on October 14th.
Instead of the all or nothing setting that exists now, individual controls for MFA, legacy authentication, and device code flow would be available.
At present, it is in private preview for some tenants.
A pretty cool update for us who have many Business Basic/Standard tenants.
6
u/No_Philosopher4051 2d ago
Seems like this would be very useful if you could not buy entra p1/p2 for all users since today you need to turn security defaults off to use Conditional Access. Microsoft should have had this many years ago
3
u/norbie MSP - UK 2d ago
Blocking device code flow has been available as part of Security Defaults since June 2026 but for new tenants only.
There’s currently no way to block this without P1/P2 licenses on older tenants. So those with the likes of Business Standard cannot currently get this.
As always with MS, you’re never quite sure until it’s released, but hopefully this means we can get it turned on soon for older tenants. Seen recently a few successful phishing attacks using this method - user doesn’t need to enter their password, just paste the code on to genuine MS page and authenticate - even with a Yubikey which really kills the “phish resistant” angle.
•
u/BeardedITDude 12h ago
This is a great change for those who can't stomach the jump to premium or P1 licenses.
-8
u/roll_for_initiative_ MSP - US 2d ago
I mean, i get the excitement but i feel this is undercutting the value of those of us that invested in P1 like busprem over standard.
7
u/IAmSoWinning 2d ago
Let the poors have some better security without complaining, eh?
This is good for literally everyone.
4
u/CPAlexander 1d ago
wow... there are some times you can tell SO much about someone from one seemingly innocuous statement...
-2
u/roll_for_initiative_ MSP - US 1d ago edited 1d ago
Hey, i get the downvotes and hate and it's a positive for everyone to get better security, but my feeling:
The MAIN reason we moved our entire client base to BusPrem probably 10 or so years ago, eating the cost until client renewals, was to get P1 and caps. Some of the most valuable ones we felt were necessary are some of these policies that they're basically giving away for free.
I'm not saying it's a bad thing, just maybe we should get a $1 or $2 price break on BusPrem now because they made one of the defining reasons to get it available to everyone?
Chevy used to sell a v6 and v8 Camaro, and of course there was an upcharge for the v8. Imagine you bought the v8 for 25% more and the next year they made the v8 standard and dropped the v6. You'd feel a twinge of saltiness right? Not that others shouldn't have a v8, just that, if they could afford to let everyone have a v8 now, maybe you shouldn't have been upcharged as hard then.
But then again, i guess standard users have been getting price increases like crazy and busprem hasn't, and they haven't really given you guys any value, so have at it.
4
u/mattmbit 1d ago
I think your not getting it and are stuck in this mentality of now the poor people have what I have too I should get a break.
This was a way over due change and something Microsoft needed to force out. Basic security principles SHOULD NOT BE HELD BEHIND A PAYWALL. It's that simple.
I made a thread months ago that basic conditional access policies should be available to everyone and this is a step in the right direction of this. My Busness Prem users will continue to get all of the additional security features they pay for but I can sleep a bit better knowing my Standard/Basic users have increased security to modern standards.
-1
u/roll_for_initiative_ MSP - US 1d ago
I think your not getting it and are stuck in this mentality of now the poor people have what I have too I should get a break.
I'm not "stuck": two things can be true at once: I agree caps should have never been locked behind the paywall P1 and that it's overdue but I am also annoyed we have paid the MS tax to get them anyway because, frankly, i feel it was almost negligent not to, and they've finally relented and admitted we were right 10 years later?
If i paid my taxes and followed the rules and then they came out and said "guess what? a lot of people didn't go through that effort and didn't pay their taxes, we're just going to forgive them", yeah, i feel silly for having paid them all along. No shade on you guys for finally getting what should be included but shade on MS for just not doing it that way originally.
1
u/mattmbit 1d ago
Except your taxes haven't had elaborat changes to the way hackers and criminals are abusing systems to gain access to mailboxes. Your stuck in the wrong analogy.
Security Defaults have always been in place they just are showing their age and are getting a bump to their proper defaults. Standard users aren't getting anything extra that you've been paying for all these years. They are getting a minor bump to deal with the current environment we're in security wise. You cannot hold security settings behind a paywall. Period. It's a customers right to dictate what they want to pay and what they expect from Microsoft and this is 5 years over due.
As a Business Prem user, reseller and person that has gone through those conversations with my clients I have no resentment at all for Standard/Basic users getting this bump. It's very telling of you that instead of welcoming this your portraying yourself in this "I've been wronged" attitude. We need to be forcing companies like Microsoft to stop trying to take advantage of us with these bogus paywalls and do what's right.
0
u/roll_for_initiative_ MSP - US 1d ago
It's friday and i'm not going to argue on reddit all day so, here's my last thoughts:
" Your stuck..." - *You're
Security defaults hasn't ALWAYS been in place, they were introduced in like 2019. There was really nothing for non p1 users before that. I agree that they should have been better when introduced (like always enforced mfa instead of selectively) but whatever.
"It's very telling of you" no, that's you reading into something and telling of you that you feel my comments wronged you somehow. But i didn't wrong you; take the armchair psych analysis elsewhere.
"I have no resentment at all for Standard/Basic users getting this bump" - i have no resentment against those people at all, you are injecting that so you have something to argue about. I do have resentment against MS for making us pay to get CAPs for like a decade now and then doing the silly security defaults thing in the first place and now this halfway security defaults update which is an improvement, to be sure, but had to cost them more to develop than just unlocking CAPs. But here's one better: just make P1 part of entra free for all and move P2 to BusPrem. Instead, we're getting milked again, all of us: non-P1 people with half-CAPs, and P1 people with no movement at all despite "elaborat changes to the way hackers and criminals are abusing systems to gain access"
•
u/teriaavibes 19h ago
There was really nothing for non p1 users before that.
Nope, per user MFA was a thing and still is.
Rest of your arguments are just so wild, I am not wasting time addressing them.
1
18
u/SmokingCrop- 2d ago
Ah, finally : "This rule requires MFA for all users within its scope, including administrators. It broadens the original Security Defaults behavior from requiring MFA when necessary to requiring MFA for the sign-ins covered by the rule."
A more strict MFA rule was definitely necessary for the Exchange online/basic/standard licenses