All clients
Compare any report across every client you look after.
Which methods people may register and use, from the tenant's authentication methods policy, against what's recommended for a small business.
| Setting | Current | Recommended | Why |
|---|---|---|---|
| Passkeys and security keys (FIDO2) | On for Break glass | On | Needed for phishing-resistant sign-in, which admins should use. |
| Microsoft Authenticator | On for All users | On | The second factor most people should use. |
| Authenticator shows which app is signing in | Microsoft managed | On (Microsoft managed turns it on) | Helps people spot a sign-in that isn't theirs. |
| Voice call | Off | Off | Calls can be redirected, and are easy to approve by mistake. |
| Email one-time passcode | On for All users | Off, unless guests or password reset need it | Not a second factor for members; only for password reset and guests. |
| Temporary Access Pass | Off | On, for setting up passkeys | A time-limited pass for setting up a new phone or passkey. |
| Registration campaign (asks people to set up Authenticator at sign-in) | Microsoft managed, for All users, can be skipped for 1 day | On, or Microsoft managed | Moves people off text messages and calls. |
| People can report an MFA prompt they didn't expect | Microsoft managed | On | A reported prompt blocks the account's risky sign-ins and alerts admins. |
| Methods managed in this policy (not the old MFA and SSPR settings) | Yes | Yes | Microsoft has retired the old per-user MFA and SSPR method settings. |
| Passkeys and security keys (FIDO2) | On for Break glass | On | Needed for phishing-resistant sign-in, which admins should use. |
| Microsoft Authenticator | On for All users | On | The second factor most people should use. |
| Authenticator shows which app is signing in | Microsoft managed | On (Microsoft managed turns it on) | Helps people spot a sign-in that isn't theirs. |
| Voice call | Off | Off | Calls can be redirected, and are easy to approve by mistake. |
| Email one-time passcode | On for All users | Off, unless guests or password reset need it | Not a second factor for members; only for password reset and guests. |
| Temporary Access Pass | Off | On, for setting up passkeys | A time-limited pass for setting up a new phone or passkey. |
| Registration campaign (asks people to set up Authenticator at sign-in) | Microsoft managed, for All users, can be skipped for 1 day | On, or Microsoft managed | Moves people off text messages and calls. |
| People can report an MFA prompt they didn't expect | Microsoft managed | On | A reported prompt blocks the account's risky sign-ins and alerts admins. |
| Methods managed in this policy (not the old MFA and SSPR settings) | Yes | Yes | Microsoft has retired the old per-user MFA and SSPR method settings. |
| Passkeys and security keys (FIDO2) | On for Break glass | On | Needed for phishing-resistant sign-in, which admins should use. |
| Microsoft Authenticator | On for All users | On | The second factor most people should use. |
| Authenticator shows which app is signing in | Microsoft managed | On (Microsoft managed turns it on) | Helps people spot a sign-in that isn't theirs. |
| Voice call | Off | Off | Calls can be redirected, and are easy to approve by mistake. |
| Email one-time passcode | On for All users | Off, unless guests or password reset need it | Not a second factor for members; only for password reset and guests. |
| Temporary Access Pass | Off | On, for setting up passkeys | A time-limited pass for setting up a new phone or passkey. |
| Registration campaign (asks people to set up Authenticator at sign-in) | Microsoft managed, for All users, can be skipped for 1 day | On, or Microsoft managed | Moves people off text messages and calls. |
| People can report an MFA prompt they didn't expect | Microsoft managed | On | A reported prompt blocks the account's risky sign-ins and alerts admins. |
| Methods managed in this policy (not the old MFA and SSPR settings) | Yes | Yes | Microsoft has retired the old per-user MFA and SSPR method settings. |
Built from each client's latest collection with the same report as the client's own page. Select a client's name to open its report.