Skip to content
Octiga Docs
Copy as Markdown

MFA (Deprecated)

ScopeGroupRoleL1 Read to view · L1 Read/Write to act

Multi Factor Authentication (Deprecated).

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

Configure it

This baseline applies per user, through a user-level scheme or an Azure group, rather than to the tenant as a whole.

  1. Add it directly to a user or an Azure group (Adding a baseline), or bundle it into a user-level scheme and deploy that to many users or groups at once (Deploying a scheme). See Groups and priority for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.

  2. There’s nothing else to configure. This baseline passes once a user has registered at least one multi-factor authentication method, such as an authenticator app, a phone number or a security key, however that registration happened.

  3. Registering a method is a step only the user can take, so this baseline has no Auto-remediation switch. Treat a deviation as a reminder to follow up with the user.

  4. Save.

Check it worked

Passing means the user has at least one MFA method registered. Check the detail in the Microsoft Entra admin centre, under Identity → Users → the user → Authentication methods. On the user roster or a group’s member list, Passing shows as a green dot for this baseline; Deviated (red) means nothing is registered yet. Microsoft prompts an unregistered user to register the next time they sign in through a browser or a modern app.

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme