Microsoft Entra "security defaults" to make MFA setup mandatory

Microsoft will require immediate MFA registration for all users in Entra tenants with security defaults enabled, eliminating the 14-day deferment window; the policy applies to new tenants on December 2, 2024, and will begin rolling out to existing tenants in January 2025. The report explains how security defaults protect against common attacks and advises admins not using Conditional Access to enable them, while noting Microsoft’s broader MFA enforcement plans for admin portals and GitHub’s 2FA mandate to increase identity security.