Requiring users to register for MFA using the Authenticator app.Security Defaults are now activated by default in all the newly created tenants since October 2019, and Microsoft is rolling them out to existing tenants who don’t have Conditional Access Policies enabled.

If you wish to learn more about Conditional Access, I wrote a post about it: Also, Conditional Access Policies require Azure Active Directory Premium P1, and only some organizations are licensed for it. In more complex environments, going the Conditional Access way can be trickier to manage but provide more benefits, such as the ability to require access from known and compliant devices. If you are currently using Conditional Access Policies, Security Defaults are probably not for you. These settings are aimed at small and medium businesses that might not have an IT team with the knowledge or resources to manually set the standard for their environment. They can be enabled on a tenant with just one click. Security defaults are a set of security settings to help you protect your organization from the most common security threats. Security Defaults are one of the ways to establish a fundamental identity security baseline for your tenant.

Azure security defaults