# Access Management > Baselines that set how people sign in, flag dormant accounts and control app consent, at tenant and group scope. Access Management is Octiga's broadest category: how people sign in, how stale accounts get noticed, and how much trust a Microsoft 365 tenant hands out by default. Most of its nineteen baselines are tenant-wide (authentication methods, the password policy, cross-tenant trust, consent settings). Dormant Users, Dormant Admins, Per User MFA and Shared Mailbox Sign In apply per user or Azure group instead, and resolve as [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) describes. ## Why it matters These settings shape the tenant's identity posture behind every sign-in. A weak or inconsistent set of authentication methods (SMS left on, Authenticator not required, a legacy per-user MFA setup nobody has revisited) gives attackers more ways in and gives you less confidence in what a sign-in proves. Dormant accounts, especially dormant admin accounts nobody disabled, are attractive targets because no one is watching them. And a tenant that lets any user consent to any app's permission request has left that decision to whoever asks first. ## How Microsoft evaluates it Each authentication-method baseline (Microsoft Authenticator, SMS, Voice, Email OTP, FIDO2 passkeys, Temporary Access Pass, certificate-based authentication) maps to one method in Microsoft Entra ID's Authentication methods policy. That tenant-wide policy controls who can register and use each method, and is checked at registration and at every sign-in that needs a second factor. Security Defaults is different: a single tenant-wide toggle for Microsoft's own fixed set of protections, which can take precedence over some Conditional Access configuration. Dormant Users and Dormant Admins read each user's last sign-in activity, which needs Entra ID P1 or P2 to report. Password Policy and Cross-Tenant Access Settings are tenant-wide Entra ID objects, checked directly rather than at sign-in. ## What end users experience Changing an authentication method changes what a user is offered the next time they register for MFA or reset their password: a passkey option appears, or SMS codes stop arriving. Dormant Users and Dormant Admins only report; the account works as before, and an admin sees it flagged for review. Shared Mailbox Sign In and Per User MFA can stop a specific account signing in directly, or add a prompt to it, without affecting anyone who uses the mailbox through delegation. Admin Consent Workflow and User Consent Settings change what happens when a user opens a new app: the consent prompt becomes a request awaiting review, or disappears if user consent is turned off. | Baseline | Scope | Licence | | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | ----------------- | | [Admin Consent Workflow](https://docs.octiga.io/baselines/access-management/admin-consent-workflow/) | Tenant | — | | [Authentication Method Policy - Certificate-Based Authentication](https://docs.octiga.io/baselines/access-management/authentication-methods-certificate-based/) | Tenant | — | | [Authentication Method Policy - Email OTP](https://docs.octiga.io/baselines/access-management/authentication-methods-email-otp/) | Tenant | — | | [Authentication Method Policy - Microsoft Authenticator](https://docs.octiga.io/baselines/access-management/authentication-methods-microsoft-authenticator/) | Tenant | — | | [Authentication Method Policy - Passkey (FIDO2)](https://docs.octiga.io/baselines/access-management/authentication-methods-fido2/) | Tenant | — | | [Authentication Method Policy - SMS](https://docs.octiga.io/baselines/access-management/authentication-methods-sms/) | Tenant | — | | [Authentication Method Policy - Temporary Access Pass](https://docs.octiga.io/baselines/access-management/authentication-methods-temporary-access-pass/) | Tenant | — | | [Authentication Method Policy - Voice Call](https://docs.octiga.io/baselines/access-management/authentication-methods-voice/) | Tenant | — | | [Cross-Tenant Access Settings](https://docs.octiga.io/baselines/access-management/cross-tenant-access-settings/) | Tenant | — | | [Customer Lockbox](https://docs.octiga.io/baselines/access-management/org-customer-lockbox/) | Tenant | Customer Lockbox | | [Dormant Admins](https://docs.octiga.io/baselines/access-management/dormant-admins/) | Group | Entra ID P1 or P2 | | [Dormant Users](https://docs.octiga.io/baselines/access-management/dormant-users/) | Group | Entra ID P1 or P2 | | [MFA (Deprecated)](https://docs.octiga.io/baselines/access-management/mfa/) | Group | — | | [Password Policy](https://docs.octiga.io/baselines/access-management/domain-password-policy/) | Tenant | — | | [Password Protection](https://docs.octiga.io/baselines/access-management/password-rule-settings/) | Tenant | — | | [Per User MFA](https://docs.octiga.io/baselines/access-management/per-user-mfa-state/) | Group | — | | [Security Defaults Policy](https://docs.octiga.io/baselines/access-management/security-defaults-policy/) | Tenant | — | | [Shared Mailbox Sign In](https://docs.octiga.io/baselines/access-management/account-enabled/) | Group | — | | [User Consent Settings](https://docs.octiga.io/baselines/access-management/user-consent-work-flow/) | Tenant | — |