diff --git a/tests/providers/microsoft365/services/entra/entra_security_defaults_enabled/m365_entra_security_defaults_enabled_test.py b/tests/providers/microsoft365/services/entra/entra_security_defaults_enabled/m365_entra_security_defaults_enabled_test.py
new file mode 100644
index 0000000000..131b4bf06a
--- /dev/null
+++ b/tests/providers/microsoft365/services/entra/entra_security_defaults_enabled/m365_entra_security_defaults_enabled_test.py
@@ -0,0 +1,94 @@
+from unittest import mock
+from uuid import uuid4
+
+from tests.providers.microsoft365.microsoft365_fixtures import (
+    set_mocked_microsoft365_provider,
+)
+
+
+class Test_entra_security_defaults_enabled:
+    def test_entra_tenant_empty(self):
+        entra_client = mock.MagicMock
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_microsoft365_provider(),
+        ), mock.patch(
+            "prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled.entra_client",
+            new=entra_client,
+        ):
+            from prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled import (
+                entra_security_defaults_enabled,
+            )
+
+            entra_client.security_defaults = None
+
+            check = entra_security_defaults_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == "Entra Security Defaults is disabled."
+            assert result[0].resource_name == ""
+            assert result[0].resource_id == ""
+
+    def test_entra_security_defaults_enabled(self):
+        entra_client = mock.MagicMock
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_microsoft365_provider(),
+        ), mock.patch(
+            "prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled.entra_client",
+            new=entra_client,
+        ):
+            from prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled import (
+                entra_security_defaults_enabled,
+            )
+            from prowler.providers.microsoft365.services.entra.entra_service import (
+                SecurityDefaults,
+            )
+
+            id = str(uuid4())
+
+            entra_client.security_defaults = SecurityDefaults(
+                id=id, name="Sec Default", is_enabled=True
+            )
+
+            check = entra_security_defaults_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == "Entra Security Defaults is enabled."
+            assert result[0].resource_name == "Sec Default"
+            assert result[0].resource_id == id
+
+    def test_entra_security_default_disabled(self):
+        entra_client = mock.MagicMock
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_microsoft365_provider(),
+        ), mock.patch(
+            "prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled.entra_client",
+            new=entra_client,
+        ):
+            from prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled import (
+                entra_security_defaults_enabled,
+            )
+            from prowler.providers.microsoft365.services.entra.entra_service import (
+                SecurityDefaults,
+            )
+
+            id = str(uuid4())
+
+            entra_client.security_defaults = SecurityDefaults(
+                id=id, name="Sec Default", is_enabled=False
+            )
+
+            check = entra_security_defaults_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == "Entra Security Defaults is disabled."
+            assert result[0].resource_name == "Sec Default"
+            assert result[0].resource_id == id