You configure a new Microsoft 36S tenant to use a default domain name of contosso.

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Microsoft Learn module “Plan and implement Conditional Access policies” , enabling or customizing Conditional Access policies requires that Security Defaults in Azure AD be disabled .

Security defaults provide a basic level of protection, such as enforcing MFA for all users and blocking legacy authentication. However, when Security Defaults are enabled, custom Conditional Access policies cannot be created because both features manage sign-in risk and access control.

From the Microsoft documentation:

“To use Conditional Access policies, you must disable security defaults. Conditional Access policies provide more granularity and flexibility than security defaults.”

Therefore, before you can control access to Microsoft 365 resources through Conditional Access, the first step is to disable Security Defaults in the Azure AD tenant.