You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/how-to-mfa-additional-context.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -36,7 +36,7 @@ The additional context can be combined with [number matching](how-to-mfa-number-
36
36
37
37
### Policy schema changes
38
38
39
-
You can enable and disable application name and geographic location separately. Under featureSettings, you can use the following name mapping for each features:
39
+
You can enable and disable application name and geographic location separately. Under featureSettings, you can use the following name mapping for each feature:
@@ -275,7 +275,7 @@ Only users who are enabled for Microsoft Authenticator under Microsoft Authentic
275
275
In **featureSettings**, change the states of **displayAppInformationRequiredState** and **displayLocationInformationRequiredState** from **default** to **enabled.**
276
276
Inside the **includeTarget** for each featureSetting, change the **id** from **all_users** to the ObjectID of the group from the Azure AD portal.
277
277
278
-
In addition, for each of the features, you'll change the id of the excludeTarget to the ObjectID of the group from the Azure AD portal. This will exclude that group from seeing application name or geographic location.
278
+
In addition, for each of the features, you'll change the id of the excludeTarget to the ObjectID of the group from the Azure AD portal. This change excludes that group from seeing application name or geographic location.
279
279
280
280
You need to PATCH the entire schema to prevent overwriting any previous configuration. We recommend that you do a GET first, and then update only the relevant fields and then PATCH. The following example shows an update to **displayAppInformationRequiredState** and **displayLocationInformationRequiredState** under **featureSettings**.
| excludeTarget | featureTarget | A single entity that is excluded from this feature. <br> Please note: You'll be able to only exclude one group for number matching. |
147
-
| includeTarget | featureTarget | A single entity that is included in this feature. <br> Please note: You'll be able to only set one group for number matching.|
146
+
| excludeTarget | featureTarget | A single entity that is excluded from this feature. <br>You can only exclude one group for number matching. |
147
+
| includeTarget | featureTarget | A single entity that is included in this feature. <br>You can only include one group for number matching.|
148
148
| State | advancedConfigState | Possible values are:<br>**enabled** explicitly enables the feature for the selected group.<br>**disabled** explicitly disables the feature for the selected group.<br>**default** allows Azure AD to manage whether the feature is enabled or not for the selected group. |
In **featureSettings**, you'll need to change the **numberMatchingRequiredState** from **default** to **enabled**.
165
165
166
-
Note that the value of Authentication Mode can be either **any** or **push**, depending on whether or not you also want to enable passwordless phone sign-in. In these examples, we will use **any**, but if you don't want to allow passwordless, use **push**.
166
+
The value of Authentication Mode can be either **any** or **push**, depending on whether or not you also want to enable passwordless phone sign-in. In these examples, we will use **any**, but if you don't want to allow passwordless, use **push**.
167
167
168
168
>[!NOTE]
169
169
>For passwordless users, enabling or disabling number matching has no impact because it's already part of the passwordless experience.
@@ -208,7 +208,7 @@ Only users who are enabled for Microsoft Authenticator under Microsoft Authentic
208
208
209
209
```
210
210
211
-
To confirm this has applied, please run the GET request by using the following endpoint:
211
+
To confirm the change is applied, run the GET request by using the following endpoint:
212
212
213
213
```http
214
214
GET https://graph.microsoft.com/beta/authenticationMethodsPolicy/authenticationMethodConfigurations/MicrosoftAuthenticator
0 commit comments