# Per User MFA

> Per User MFA.

Per User MFA.

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline applies per user, through a user-level scheme or an Azure group, rather than to the tenant as a whole.

1. Add it directly to a user or an Azure group ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or bundle it into a user-level scheme and deploy that to many users or groups at once ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). See [Groups and priority](https://docs.octiga.io/baselines/groups-and-priority/) for how Octiga resolves which value a user gets when a Direct value, a scheme and a group all supply one.
2. Move the user's per-user MFA status off Disabled. This is the only setting on this baseline, and it passes at either Enabled or Enforced. Set new enrolments to Enabled: the user keeps using legacy authentication until they finish registering, at which point Microsoft moves them to Enforced automatically.
3. Save. Turn on **Auto-remediation** if you'd like Octiga to enrol a Disabled user for you. It sets them to Enabled, the same safe starting state, and never jumps a user straight to Enforced.

> **Caution:** Enforced blocks legacy authentication protocols outright (they need an app password instead) and requires MFA registration or a fresh sign-in for everything else. Set a user to Enforced directly only once you know they've registered; for someone who hasn't, it interrupts their access rather than prompting them.

## Check it worked

Passing means the user's status is Enabled or Enforced. Check it in the Microsoft Entra admin centre, under **Identity → Users → Per-user MFA**. On the user roster or a group's member list, Passing shows as a green dot for this baseline; Deviated (red) means the user is still Disabled. A newly Enabled user notices a registration prompt at their next sign-in; once Enforced, they're asked for MFA at every sign-in that needs it.

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)