
The Security Defaults within Microsoft 365 reside within Azure Active Directory. These features are either available as separate add-on licenses or bundled into the either the Enterprise Mobility + Security E3/A3/G3, Enterprise Mobility + Security E5/A5/G5, Microsoft 365 E3/A3/G3, Microsoft 365 E5/A5/G5, Microsoft 365 E5/A5/G5 Security, and Microsoft 365 Business Premium. Features, such as the Security Defaults, are included in core licenses however, most advanced Security capabilities are not. With all of the Microsoft 365 services, many-core security components come with the standard licensing. Organization Security is a combination of Security Controls and Protection, combined with end-user training and guidance. Security within Microsoft 365 is not just about enabling features and controls it also involves the human side of teaching and guiding users to understand the restrictions and what they should be doing to help. Organization-specific security controls and procedures should augment all out of the box configuration. These are a great start however, they shouldn't be the only configuration organizations should use. Out of the box, newer tenants have the Security Defaults enabled that implement some necessary and best-practice capabilities. Each service is protected predominantly by Azure Active Directory for Authentication, with each application authorizing users to access either the app itself content that resides within. Microsoft 365, as a service, contains many administration portals, options, and configuration settings focused solely on Security. For official Microsoft content, see Microsoft 365 documentation.


This is an open-source article with the community providing support for it.
