Microsoft Entra SSPR: Action Needed Now

Key insights

• SSPR enforcement date
  Microsoft will enforce the change on 2026-11-09, after a registration campaign that begins 2026-10-05.
  Plan communications and actions around these dates to avoid sudden lockouts.
• Registered authentication methods required
  SSPR will accept only methods that users or admins have explicitly registered in Security info.
  Directory fields like mobilePhone or businessPhone will no longer qualify by themselves.
• At-risk users
  Users who never enrolled an authentication method but rely on profile contact values are at risk of losing SSPR access.
  Audit profiles to find accounts that lack any registered method.
• Supported methods
  Common supported options include Microsoft Authenticator, FIDO2 security keys, passkeys, SMS and voice where allowed by policy.
  Tenant Authentication Methods policy controls which options are permitted.
• Admin actions
  Review the tenant for users without registered methods, run reports, and push enrollment prompts before the enforcement date.
  Note that legacy MFA/SSPR management was deprecated on 2025-09-30, so use the Authentication Methods policy and Security info tools.
• Immediate checklist
  Identify affected users, send clear enrollment instructions, update tenant policies, and test the SSPR flow on a sample account.
  Address gaps now to prevent helpdesk incidents and account lockouts.

Keywords

Azure AD SSPR outage, SSPR deprecation notice, self-service password reset stop working, SSPR troubleshooting, fix SSPR errors, migrate SSPR settings, password reset Azure AD, prepare for SSPR change