# MFA (Deprecated)

> Multi Factor Authentication (Deprecated).

Multi Factor Authentication (Deprecated).

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline applies per user, through a user-level scheme or an Azure group, rather than to the tenant as a whole.

1. Add it directly to a user or an Azure group ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or bundle it into a user-level scheme and deploy that to many users or groups at once ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). See [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.
2. There's nothing else to configure. This baseline passes once a user has registered at least one multi-factor authentication method, such as an authenticator app, a phone number or a security key, however that registration happened.
3. Registering a method is a step only the user can take, so this baseline has no **Auto-remediation** switch. Treat a deviation as a reminder to follow up with the user.
4. Save.

## Check it worked

Passing means the user has at least one MFA method registered. Check the detail in the Microsoft Entra admin centre, under **Identity → Users** → the user → **Authentication methods**. On the user roster or a group's member list, Passing shows as a green dot for this baseline; Deviated (red) means nothing is registered yet. Microsoft prompts an unregistered user to register the next time they sign in through a browser or a modern app.

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)