How to fix External Identities MFA conditional policy enablement

Question

How to fix External Identities MFA conditional policy enablement

Nkou Tatai 0

I have registered an application on External Identities, and have associated the App with MFA policy. I get errors when trying to enable the policy indicating i need to disable the default security settings which is not recommended.

How do i solve this issues - to enable the policy (conditional) to add on the default security

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-23T17:51:11.72+00:00
Hello Nkou Tatai,

If Security Defaults is enabled in Microsoft Entra, you must disable it before using a Conditional Access policy for MFA. This is expected behavior and not related to an issue with your app registration.

Security Defaults provides baseline tenant protection such as MFA for admins, blocking legacy authentication, and other standard security controls.

Conditional Access is intended for scenarios where you need more granular control, such as enforcing MFA for specific users, selected applications, or based on conditions like device, location, or sign-in risk.

Since both features control MFA and access protection, enabling Conditional Access requires Security Defaults to be turned off first.

For an External Identities application that needs app-specific MFA, the recommended steps are:

Go to Microsoft Entra admin center → Identity → Overview → Properties → Manage Security defaults

Change Security defaults to Disabled

Save the update

Configure your MFA policy under Protection → Conditional Access

If your requirement is only standard tenant-wide protection, you can keep Security Defaults enabled and skip Conditional Access.

Also, make sure your tenant has Microsoft Entra ID P1 or P2 licensing, as Conditional Access requires it.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-25T05:27:39.84+00:00

Hello Nkou Tatai,

Any update on this? Please confirm if any further queries.
kagiyama yutaka 5,490 Reputation points

2026-04-25T08:04:33.9066667+00:00

The root is Security Defaults taking MFA before CA can even evaluate, so CA‑MFA never fires at all. turn it off once, mirror its protections as a tiny CA baseline, add your app‑MFA — and if it still breaks, clear legacy‑auth or per‑user MFA leftovers blocking CA.

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-23T17:51:11.72+00:00

Hello Nkou Tatai,

If Security Defaults is enabled in Microsoft Entra, you must disable it before using a Conditional Access policy for MFA. This is expected behavior and not related to an issue with your app registration.

Security Defaults provides baseline tenant protection such as MFA for admins, blocking legacy authentication, and other standard security controls.

Conditional Access is intended for scenarios where you need more granular control, such as enforcing MFA for specific users, selected applications, or based on conditions like device, location, or sign-in risk.

Since both features control MFA and access protection, enabling Conditional Access requires Security Defaults to be turned off first.

For an External Identities application that needs app-specific MFA, the recommended steps are:

Go to Microsoft Entra admin center → Identity → Overview → Properties → Manage Security defaults

Change Security defaults to Disabled

Save the update

Configure your MFA policy under Protection → Conditional Access

If your requirement is only standard tenant-wide protection, you can keep Security Defaults enabled and skip Conditional Access.

Also, make sure your tenant has Microsoft Entra ID P1 or P2 licensing, as Conditional Access requires it.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-25T05:27:39.84+00:00

Hello Nkou Tatai,

Any update on this? Please confirm if any further queries.
kagiyama yutaka 5,490 Reputation points

2026-04-25T08:04:33.9066667+00:00

The root is Security Defaults taking MFA before CA can even evaluate, so CA‑MFA never fires at all. turn it off once, mirror its protections as a tiny CA baseline, add your app‑MFA — and if it still breaks, clear legacy‑auth or per‑user MFA leftovers blocking CA.

Answer 1

Security defaults and Conditional Access cannot be used together. To enable a Conditional Access MFA policy for External Identities, security defaults must be disabled; there is no supported way to “add” Conditional Access on top of security defaults.

To move from security defaults to Conditional Access MFA for the external app:

Plan and test MFA via Conditional Access first:
- Create a Conditional Access policy in Report-only mode that requires MFA for the relevant users and app:
  - In the Microsoft Entra admin center, go to Entra ID > Conditional Access > Policies > New policy.
  - Under Assignments, target the relevant users (for External Identities, your external users or groups) and the registered app.
  - Under Access controls > Grant, select Grant access and Require multifactor authentication.
  - Set Enable policy to Report-only and Create.
- Use Conditional Access insights and sign-in logs to verify the impact and confirm that MFA prompts behave as expected before enforcing the policy. For details, see the guidance under “Verify MFA enablement” and Conditional Access insights and reporting.
Disable security defaults (required to turn on Conditional Access):
- In the Microsoft Entra admin center, go to Entra ID > Overview > Properties.
- Select Manage security defaults.
- Set Security defaults to Disabled and save.
- This step is necessary because if any Conditional Access policy exists (even in Off or Report-only state), security defaults cannot be enabled, and conversely, security defaults must be off to rely on Conditional Access for MFA.
Turn the Conditional Access MFA policy On:
- After confirming behavior in report-only mode, edit the policy and change Enable policy from Report-only to On.
- Ensure emergency/break-glass accounts are excluded as recommended in Conditional Access guidance.
For External Identities MFA methods (optional but common):
- If using email OTP as an MFA method for external users, enable it in the external tenant:
  - Go to Entra ID > Authentication methods.
  - Select Email OTP.
  - Turn Enable on and set Target to All users, then Save.

Key point: the “not recommended” warning is about disabling security defaults without having equivalent or stronger Conditional Access policies in place. The supported pattern is to design and validate Conditional Access MFA policies (starting in report-only), then disable security defaults, and finally enable the Conditional Access policies in On state to maintain or improve the security posture.

References: