Access Management
Access Management is Octiga’s broadest category: how people sign in, how stale accounts get noticed, and how much trust a Microsoft 365 tenant hands out by default. Most of its nineteen baselines are tenant-wide (authentication methods, the password policy, cross-tenant trust, consent settings). Dormant Users, Dormant Admins, Per User MFA and Shared Mailbox Sign In apply per user or Azure group instead, and resolve as Groups and priority describes.
Why it matters
These settings shape the tenant’s identity posture behind every sign-in. A weak or inconsistent set of authentication methods (SMS left on, Authenticator not required, a legacy per-user MFA setup nobody has revisited) gives attackers more ways in and gives you less confidence in what a sign-in proves. Dormant accounts, especially dormant admin accounts nobody disabled, are attractive targets because no one is watching them. And a tenant that lets any user consent to any app’s permission request has left that decision to whoever asks first.
How Microsoft evaluates it
Each authentication-method baseline (Microsoft Authenticator, SMS, Voice, Email OTP, FIDO2 passkeys, Temporary Access Pass, certificate-based authentication) maps to one method in Microsoft Entra ID’s Authentication methods policy. That tenant-wide policy controls who can register and use each method, and is checked at registration and at every sign-in that needs a second factor. Security Defaults is different: a single tenant-wide toggle for Microsoft’s own fixed set of protections, which can take precedence over some Conditional Access configuration. Dormant Users and Dormant Admins read each user’s last sign-in activity, which needs Entra ID P1 or P2 to report. Password Policy and Cross-Tenant Access Settings are tenant-wide Entra ID objects, checked directly rather than at sign-in.
What end users experience
Changing an authentication method changes what a user is offered the next time they register for MFA or reset their password: a passkey option appears, or SMS codes stop arriving. Dormant Users and Dormant Admins only report; the account works as before, and an admin sees it flagged for review. Shared Mailbox Sign In and Per User MFA can stop a specific account signing in directly, or add a prompt to it, without affecting anyone who uses the mailbox through delegation. Admin Consent Workflow and User Consent Settings change what happens when a user opens a new app: the consent prompt becomes a request awaiting review, or disappears if user consent is turned off.
| Baseline | Scope | Licence |
|---|---|---|
| Admin Consent Workflow | Tenant | — |
| Authentication Method Policy - Certificate-Based Authentication | Tenant | — |
| Authentication Method Policy - Email OTP | Tenant | — |
| Authentication Method Policy - Microsoft Authenticator | Tenant | — |
| Authentication Method Policy - Passkey (FIDO2) | Tenant | — |
| Authentication Method Policy - SMS | Tenant | — |
| Authentication Method Policy - Temporary Access Pass | Tenant | — |
| Authentication Method Policy - Voice Call | Tenant | — |
| Cross-Tenant Access Settings | Tenant | — |
| Customer Lockbox | Tenant | Customer Lockbox |
| Dormant Admins | Group | Entra ID P1 or P2 |
| Dormant Users | Group | Entra ID P1 or P2 |
| MFA (Deprecated) | Group | — |
| Password Policy | Tenant | — |
| Password Protection | Tenant | — |
| Per User MFA | Group | — |
| Security Defaults Policy | Tenant | — |
| Shared Mailbox Sign In | Group | — |
| User Consent Settings | Tenant | — |