Security defaults vs Conditional Access, and emergency access (break-glass) accounts

Security defaults are a free, one-switch set of identity protections that Microsoft enables for new tenants. They require all users to register for multifactor authentication (with a grace period after which registration is enforced), require administrators to perform MFA every time they sign in, prompt users for MFA when Microsoft judges it necessary, block legacy authentication protocols that can't do MFA, and protect privileged activities such as access to the Azure portal. Security defaults steer users to register Microsoft Authenticator as their MFA method. There is nothing to tune: no exclusions, no locations, no per-app rules.