# Authentication Method Policy - Microsoft Authenticator > Controls how Microsoft Authenticator is used for push and passwordless authentication, which users it applies to, and whether additional security details (app… Controls how Microsoft Authenticator is used for push and passwordless authentication, which users it applies to, and whether additional security details (app name, location, companion apps) appear in authentication prompts. ## Settings this baseline controls | Setting | What it does | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Method enabled | Specifies whether Microsoft Authenticator authentication method is enabled or disabled for the tenant. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | OTP codes enabled | Determines whether users can use Microsoft Authenticator OTP tokens for authentication. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | Included users | Groups and users explicitly included to use Microsoft Authenticator authentication method. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | Excluded users | Groups and users explicitly excluded from using Microsoft Authenticator authentication method. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | Show app name in notifications | Controls whether application context information is shown in Microsoft Authenticator notifications. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | App name included users | Users and groups included for showing application context in Microsoft Authenticator. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | App name excluded users | Users and groups excluded from showing application context in Microsoft Authenticator. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | Show location in notifications | Controls whether geographic location information is shown in Microsoft Authenticator notifications. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | **5 more settings** | Setting | What it does | | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Location included users | Users and groups included for showing location context in Microsoft Authenticator. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | Location excluded users | Users and groups excluded from showing location context in Microsoft Authenticator. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | Companion apps allowed | Controls whether companion applications can be used with Microsoft Authenticator. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | Companion app included users | Users and groups included for using companion applications with Microsoft Authenticator. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | | Companion app excluded users | Users and groups excluded from using companion applications with Microsoft Authenticator. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/microsoftauthenticatorauthenticationmethodconfiguration) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this to the tenant, or through a scheme to every tenant you manage, so Microsoft Authenticator push notifications carry enough context for a user to tell a genuine sign-in from an attacker's. 1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Turn on **Method enabled** for all users under **Included users**. 3. Turn on **Show app name in notifications** and **Show location in notifications**, both targeting all users. This lets someone spot a rogue approval request ("why is this from an app I don't use, or a country I've never been to?") instead of tapping Approve out of habit. 4. Leave **Companion apps allowed** on, and turn **OTP codes enabled** off. The baseline favours push and passwordless approval over Authenticator's fallback numeric-code mode. 5. Save. **Auto-remediation** is safe to turn on: it only reapplies the notification content and targeting settings, and can't lock anyone out of Authenticator itself. > **Caution:** Turning off OTP codes removes the option to type a numeric code instead of approving a push notification, which helps anyone with a poor data connection. Check that nobody depends on that fallback before you turn it off. ## Check it worked Passing means **Entra ID → Authentication methods → Policies → Microsoft Authenticator** shows the method enabled with app name and location both shown to all users. Users start seeing the requesting app's name and an approximate location on every Authenticator approval prompt, alongside the usual number-matching challenge. ## Standards this addresses ### CIS - **M365 5.2.3.1** — CIS M365 Foundations Benchmark 5.2.3.1 - **v8 6.3** — CIS Controls v8 Safeguard 6.3 ### NIST - **PR.AC-7** — NIST CSF 2.0 PR.AC-7 - **IA-2** — NIST SP 800-53 IA-2 - **IA-5** — NIST SP 800-53 IA-5 ### ISO 27001 - **A.8.3.3** — ISO/IEC 27001:2022 Annex A.8.3.3 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)