Baseline

Authentication Policies

CONFIG365 deploys and manages Entra ID Authentication Method Policies via the Graph API — ensuring every tenant has the right MFA methods enabled, scoped correctly, and configured to resist phishing from day one.

FIDO2TAPMicrosoft AuthenticatorMFAPhish-ResistantAuthentication Methods API

How It Works

Authentication method policies are deployed via the deployAuthenticationPolicies pipeline toggle. Each method is defined in a JSON file and the pipeline calls the Authentication Methods Policy Graph endpoint to apply the configuration idempotently.

Per-Method Scoping

Each method can be scoped to all users, specific groups, or excluded groups — independent of other methods.

Group-Based Targeting

Use {{GROUP:name}} placeholders in method targets. CONFIG365 resolves them at deploy time — no hardcoded GUIDs.

Idempotent Runs

Running the pipeline multiple times is safe. The script compares current state and only applies changes when needed.

Example: FIDO2 Policy JSON
{
  "id": "fido2",
  "state": "enabled",
  "includeTargets": [
    {
      "targetType": "group",
      "id": "{{GROUP:Baseline – Modern Workplace Users}}",
      "isRegistrationRequired": false
    }
  ],
  "fido2": {
    "isAttestationEnforced": true,
    "isSelfServiceRegistrationAllowed": true,
    "keyRestrictions": {
      "isEnforced": false
    }
  }
}

Method Reference

Default state in the CONFIG365 baseline. All defaults can be overridden per-tenant.

FIDO2 Security Keys

Enabled by default Phish-Resistant

The strongest available MFA method. FIDO2-certified hardware keys (YubiKey, etc.) provide phish-resistant authentication that cannot be intercepted by proxy attacks. Passkeys are supported where the tenant has the preview enabled.

  • • Enabled for all users
  • • Self-service registration via My Security Info
  • • Attestation enforced (only certified hardware)
  • • Key restrictions configurable per-tenant

Temporary Access Pass (TAP)

Enabled by default

A time-limited passcode issued by an admin. Used to bootstrap passwordless onboarding, recover locked accounts, or onboard new users without sharing passwords.

  • • One-time or multi-use, configurable per admin
  • • Minimum lifetime: 10 minutes, Maximum: 8 hours
  • • Issued via Entra ID portal or Graph API
  • • Required for passwordless onboarding workflows

Microsoft Authenticator

Enabled by default

Push notification MFA with number matching. Passwordless phone sign-in is enabled where supported. Number matching prevents MFA fatigue attacks by requiring the user to enter a code displayed on the login screen.

  • • Number matching enforced (prevents MFA fatigue)
  • • Additional context shown in push (app name, location)
  • • Passwordless phone sign-in enabled
  • • Android and iOS supported

SMS / Voice Call

Disabled by default

SMS and voice call OTP are disabled by default due to SIM-swapping and SS7 interception risks. Can be enabled per-tenant for legacy application compatibility where stronger methods are not feasible.

  • • Disabled tenant-wide in baseline
  • • Enableable per-tenant via pipeline parameter
  • • Not recommended for production environments
  • • Weaker than app-based or hardware methods

Software OATH Tokens

Enabled by default

TOTP-based authenticator apps (Google Authenticator, Authy, etc.) using 6-digit time-based codes. Acceptable for non-sensitive workloads. Less secure than FIDO2 or Authenticator push but widely compatible.

  • • Standard 30-second TOTP codes
  • • Compatible with any OATH-TOTP app
  • • Self-service registration via My Security Info
  • • Acceptable as a fallback method

Certificate-Based Authentication

Configured per-tenant Phish-Resistant

X.509 certificate-based authentication for scenarios requiring phish-resistant access from devices where FIDO2 is not practical. Typically used for smart card authentication in regulated environments.

  • • Requires PKI infrastructure (on-premises or cloud)
  • • Satisfies phish-resistant MFA requirement
  • • Configured per-tenant based on client infrastructure
  • • Can be used with Conditional Access filters
Back to Baseline Documentation