Authentication Method Policy - Voice Call
Ensures that the voice call authentication method is securely configured.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Method enabled | Specifies whether the voice call authentication method is enabled or disabled for the tenant. Learn more |
| Office phone allowed | Specifies whether users can register office phones for voice call authentication. Learn more |
| Excluded users | Groups and users explicitly excluded from using the voice call authentication method. Learn more |
| Included users | Groups and users explicitly included to use the voice call authentication method. Learn more |
Configure it
This baseline turns voice-call sign-in off tenant-wide. Add it to the tenant, or through a scheme, wherever you’re retiring phone-call verification in favour of stronger methods.
-
Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).
-
Turn Method enabled off. A phone call is easy to social-engineer and gives no real evidence of who picked up, so the baseline recommends against leaving it available.
-
Save. Turn on Auto-remediation if you want Octiga to switch it back off whenever someone re-enables it in Microsoft Entra.
Check it worked
Passing means Entra ID → Authentication methods → Policies → Voice call shows the method disabled. Anyone who used to be called with a verification code is prompted for a different registered method the next time they need to authenticate.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.