SSPR enforcement September 7: how to prevent users from losing self-service password reset

On September 7, 2026 — five days from now — Microsoft is enforcing a security tightening in Entra ID that can quietly cause problems: Self-Service Password Reset will from that point only accept authentication methods that users have actively registered. Anyone who has overlooked this risks employees being unable to unlock themselves from Monday onwards and having to call the helpdesk anyway.

SSPR has existed for years and works silently in the background for many organisations. That silent operation is precisely the problem: until now the system fell back on phone numbers and email addresses stored in a user's directory profile, even if the user had never actively registered those details as an authentication method. That situation ends next week.

What exactly changes on September 7?

Until now, a user trying to reset their password could be verified using contact details that an IT administrator had entered in the Entra profile, such as a work phone number or the HR email address. The user never needed to register those details through the MFA registration portal. In practice it worked, but it also created a security risk: an attacker who could modify a user's profile attributes could theoretically hijack a password reset.

From September 7, 2026, this changes. Microsoft requires that SSPR only accepts registered authentication methods — methods the user has actively configured through the registration portal or the Microsoft Authenticator app. Phone numbers and email addresses that exist only as directory attributes no longer count, no matter how accurate those details are.

Which users are at risk?

Not every user in your organisation faces the same level of risk. The vulnerable groups are primarily employees who have been with the organisation for a long time and never went through a registration wizard when SSPR was introduced, because the administrator entered their contact details manually. Additionally, users who received their account through Active Directory synchronisation without ever going through a modern registration flow are at risk.

Newer employees who set up their account through a modern onboarding process, including MFA registration via Microsoft Authenticator, are generally fine. The risk lies in the historical population: accounts created with minimal user interaction where SSPR worked based on administrator-entered data.

Check registration status before September 7

Microsoft has made reports available that give you quick insight. In the Microsoft Entra portal, navigate to Protection > Authentication Methods > Activity. Under the Registration tab you can see per user which methods are registered and whether the user qualifies for SSPR based on the required methods in your policy.

For larger environments, the Microsoft Graph API is the most efficient route. Query all users via the `credentialUserRegistrationDetails` endpoint for the `isSsprRegistered` property. Export the result to CSV and use it as a basis to identify the at-risk group. Involve team leads or HR in that process, because a phone number not showing as registered may simply mean an employee was never guided through the registration process.

When interpreting the report, pay attention to the difference between `isMfaRegistered` and `isSsprRegistered`. A user may have MFA methods configured that are not permitted as SSPR methods in your policy. Check your SSPR configuration under Entra > Password Reset > Authentication methods and determine which methods you allow — and whether your users have actually registered them.

Four steps for the next five days

The first step is to run the registration report and identify users without a valid SSPR method. The second step is to send targeted communication to these users, with a direct link to the registration portal and a clear explanation of what is expected of them and why the deadline matters.

The third step is to activate a registration campaign in Entra via Authentication Methods > Registration campaign. This feature prompts users at every sign-in to complete their authentication method registration until they meet the required threshold. You can limit the campaign to the specific users who have not yet registered.

The fourth step is practical preparation: inform your service desk that extra password reset requests may come in during the week of September 7, and make sure administrators know how to manually reset a password for users who do not complete registration in time. That is the safety valve.

What if you still have unregistered users after September 7?

Users who have not registered a valid SSPR method by the enforcement date cannot reset their own password through the standard SSPR flow. They are directed to a message stating that no suitable verification method is available. They must contact IT or the helpdesk for manual password recovery.

This resolves itself over time as all users register, but the transition period can be labour-intensive. Organisations that have always actively encouraged SSPR registration will notice almost nothing. Organisations where registration silently worked based on directory attributes may see a significant increase in helpdesk tickets in the week immediately after the deadline.

Broader perspective: authentication hygiene as an ongoing process

The SSPR tightening is part of a broader Microsoft movement to increase trust in authentication methods. Earlier, support for SMS and voice as MFA methods was phased out, and the SSPR enforcement aligns with the broader strategy of accepting only actively managed and verified methods.

For IT teams, this is a moment to evaluate broader authentication hygiene. Are security questions still enabled as an SSPR method? These offer little protection and the advice is to disable them. Are there users with outdated phone numbers after a device change or job change? A one-time clean-up of the registration population has a permanent positive effect on the quality of your authentication landscape.

Want help running the registration report, configuring a registration campaign, or reviewing your overall SSPR policy? Contact Zarioh — we know the Entra environment and will help you take the right steps quickly.