PIM Manager settings · Settings > Automation

Sign-in methods an admin account must have (at least one of them)

Key	RequiredAuthMethods
Where	Settings > Automation > Admin accounts
Type	List
Default	microsoftAuthenticator, passkey, fido2, windowsHelloForBusiness, certificate

What it does

The validation checks the sign-in methods registered on each admin account. An admin with none of the methods in this list is reported, and so is an admin who has only weak methods (text message, voice call, e-mail). The names are the method names Microsoft Entra ID uses.

When set

When set: an admin must have at least one of the methods you listed. The report is a warning on the validation; no commit is blocked and no account is changed.

When blank or default

When blank or default: the list is the Microsoft Authenticator app, a passkey, a FIDO2 security key, Windows Hello for Business and a certificate.

Risk and how to reverse it

None for access: this only changes which admins get a warning. Taking strong methods out of the list produces warnings for admins who are well protected. Text message, voice call, phone and e-mail cannot be put in the list. Reversible: change the list or go back to the default.

Requires

SuperAdmin to change it. Up to 12 method names, letters and digits only. The check runs only when the engine may read the sign-in methods of users and that data has been read.