Requiring all users and admins to register for MFA.

Security defaults contain all the settings pre-configured to protect organisations from common attacks such as: Require MFA for service management (preview).These four policies are due to be deprecated on the 29th February 2020 and replaced by something called “Security Defaults”. In 2014, we started making these technologies available to our Azure Active Directory (AD) organizational customers, and we’ve learned that they’re very effective – for example, our telemetry tells us that more than 99.9% of organization account compromise could be stopped by simply using MFA, and that disabling legacy authentication correlates to a 67% reduction in compromise risk (and completely stops password spray attacks, 100% of which come in via legacy authentication). Microsoft have had the intention of protecting your Azure AD tenant for a few years and have allowed administrators to enable any or all of the four baseline policies automatically created in Conditional Access in Azure AD. Switch on Security Defaults One switch to enable the recommended security settings that will protect your tenant from common attacks.

Azure security defaults