Exam MD-101 topic 3 question 84 discussion

To enable Conditional Access policies, User1 should first **Disable Security defaults**. Security defaults is a basic identity security feature that's enabled by default. However, it doesn't support more advanced features of Azure AD Conditional Access. Therefore, to use Conditional Access policies, Security defaults must be disabled. So, the correct answer is **C. Disable Security defaults**.

Request the Conditional Access Administrator role. If User1 doesn't have this role, it won't be able to disable the security defaults setting in the new tenant created. So, this have to be the first step, otherwise, nothing can be done in term of conditional access.

User1 should connect the on-premises Active Directory to Azure AD using Azure AD Connect to sync the user and group objects from on-premises to Azure AD. This will ensure that User1 has the necessary permissions to enable Conditional Access policies. Once the sync is complete, User1 can access the Azure portal and configure Conditional Access policies according to the organization's security requirements.

i thought only conditional access administrator can enable CA policies or disable security defaults, boy was i wrong. To disable security defaults in your directory: Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator. Browse to Azure Active Directory > Properties. Select Manage security defaults. Set the Enable security defaults toggle to No. Select Save. reference: https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

I agree with jonny_sims "Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults." https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

This was in the Udemy MD-101 Course I took by John..mentioned this and upon testing i can tell you this is correct. If you do not turn off then you will get an error message.

you first need an azure ad connection to implement mfa i presume?

I would go with Register MFA

Require administrators to do multifactor authentication -Security administrator Has the ability to use CA policies but first need to register MFA. https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults