Merge pull request #232829 from Justinha/sys-mfa-ga

added screenshot

Author: v-dirichards

articles/active-directory/authentication/concept-system-preferred-multifactor-authentication.md

@@ -4,7 +4,7 @@ description: Learn how to use system-preferred multifactor authentication
 ms.service: active-directory
 ms.subservice: authentication
 ms.topic: conceptual
-ms.date: 03/31/2023
+ms.date: 04/03/2023
 ms.author: justinha
 author: justinha
 manager: amycolannino
@@ -27,7 +27,20 @@ After system-preferred MFA is enabled, the authentication system does all the wo
 >[!NOTE]
 >System-preferred MFA is a key security upgrade to traditional second factor notifications. We highly recommend enabling system-preferred MFA in the near term for improved sign-in security. 
 
-## Enable system-preferred MFA
+## Enable system-preferred MFA in the Azure portal
+
+By default, system-preferred MFA is Microsoft managed and disabled for all users. 
+
+1. In the Azure portal, click **Security** > **Authentication methods** > **Settings**.
+1. For **System-preferred multifactor authentication**, choose whether to explicitly enable or disable the feature, and include or exclude any users. Excluded groups take precedence over include groups. 
+
+   For example, the following screenshot shows how to make system-preferred MFA explicitly enabled for only the Engineering group. 
+
+   :::image type="content" border="true" source="./media/concept-system-preferred-multifactor-authentication/enable.png" alt-text="Screenshot of how to enable Microsoft Authenticator settings for Push authentication mode.":::
+
+1. After you finish making any changes, click **Save**. 
+
+## Enable system-preferred MFA using Graph APIs
 
 To enable system-preferred MFA in advance, you need to choose a single target group for the schema configuration, as shown in the [Request](#request) example. 
 
@@ -47,7 +60,7 @@ System-preferred MFA can be enabled only for a single group, which can be a dyna
 
 | Property | Type | Description |
 |----------|------|-------------|
-| id | String | ID of the entity targeted. |
+| ID | String | ID of the entity targeted. |
 | targetType | featureTargetType | The kind of entity targeted, such as group, role, or administrative unit. The possible values are: 'group', 'administrativeUnit', 'role', 'unknownFutureValue'. |
 
 Use the following API endpoint to enable **systemCredentialPreferences** and include or exclude groups: