If you just keep adding scopes to the same account, you eventually have a service principle that do everything which is a risk. We tried disabling and re-enabling MFA and then tried resetting passwords because it was giving. I was pretty confused because most users already had MFA on so i wasn't sure why they couldn't connect anymore. Login to Office 365 using global admin Click the admin and click Azure Active Directory Click Azure Active Directory as shown below. Security defaults in Azure Active Directory (Azure AD) make it easier to be secure and help protect your organization. We just enabled security defaults and it broke everybodies connection in outlook. Regarding Microsoft Graph PowerShell module, I have only started using it however I would lean towards using a separate temporary service principal account for each use and then deleting it. Azure Security Defaults breaking desktop outlook. I have seen people disable and then forget to implement some of basic features they implement).

One of the easiest ways would be the following: >Login a Global Admin>Admin Centers>Azure Active Directory>Propoperties>Manage Security Defaults.

If you have the per-user MFA enabled there is a subtle hyperlink named 'Configure app without notifications' on the page with the QR code. You can navigate to these policies is a couple of different ways. Security Defaults is a single configuration that enables several preconfigured controls for a tenant. To see what permission scopes you require, you need to check the Microsoft Graph API docs: Ĭouple of things that might be worth noting, obviously I would recommend you review what security defaults enables in the tenant and decide if you need want/need to mimic some of them settings with conditional policies (security defaults are a good way to get some basic extra security features without needing extra licenses. If you have 'security defaults' enabled in your tenant there is a hyperlink to use another authenticator at the start of the enrollment when you logon without MFA setup.

I don’t think its exposed in AzureAD or any AZ modules, however using the Microsoft Graph PowerShell module you can set it:

Azure security defaults