# Authentication Method Policy - Voice Call

> Ensures that the voice call authentication method is securely configured.

Ensures that the voice call authentication method is securely configured.

## Settings this baseline controls

| Setting              | What it does                                                                                                                                                                                             |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Method enabled       | Specifies whether the voice call authentication method is enabled or disabled for the tenant. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/voiceauthenticationmethodconfiguration) |
| Office phone allowed | Specifies whether users can register office phones for voice call authentication. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/voiceauthenticationmethodconfiguration)             |
| Excluded users       | Groups and users explicitly excluded from using the voice call authentication method. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/voiceauthenticationmethodconfiguration)         |
| Included users       | Groups and users explicitly included to use the voice call authentication method. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/voiceauthenticationmethodconfiguration)             |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline turns voice-call sign-in off tenant-wide. Add it to the tenant, or through a scheme, wherever you're retiring phone-call verification in favour of stronger methods.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Turn **Method enabled** off. A phone call is easy to social-engineer and gives no real evidence of who picked up, so the baseline recommends against leaving it available.
3. Save. Turn on **Auto-remediation** if you want Octiga to switch it back off whenever someone re-enables it in Microsoft Entra.

> **Caution:** Some users, particularly anyone without a smartphone, may have a phone call as their only registered method, and would be unable to sign in once it's disabled. Check who relies on it and get them registered on [Authentication Method Policy - Microsoft Authenticator](https://docs.octiga.io/baselines/access-management/authentication-methods-microsoft-authenticator/) or another method first.

## Check it worked

Passing means **Entra ID → Authentication methods → Policies → Voice call** shows the method disabled. Anyone who used to be called with a verification code is prompted for a different registered method the next time they need to authenticate.

## Standards this addresses

### CIS

- **M365 5.2.3.x** — CIS M365 Foundations Benchmark 5.2.3.x
- **v8 6.3** — CIS Controls v8 Safeguard 6.3

### ISO 27001

- **A.8.3.3** — ISO/IEC 27001:2022 Annex A.8.3.3

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)