Authentication methods policy: Microsoft Authenticator, passkeys (FIDO2), Windows Hello for Business, certificate-based authentication, Temporary Access Pass, SMS/voice

The Authentication methods policy is the central place in Microsoft Entra ID to decide which methods users may register and use for sign-in, MFA and self-service password reset. Older tenants had separate legacy MFA and SSPR policies; Microsoft has been migrating everyone to the unified policy, and new configuration belongs there. For each method you enable or disable it, target it to all users or selected groups, exclude groups, and set method-specific options.