StashGrid

Home › The Stash

Entra SSPR: Registered Methods Only From November 2026

TrainingOctober 15, 2026

Identity ticketUpdated 14 Oct 2026

Identity ticket of the week. If you run SSPR in Entra ID, this is the change most likely to land on your desk in November: methods your users never explicitly registered are about to stop counting.

What changed

On 5 October 2026 Microsoft began a registration campaign for self-service password reset (SSPR), and from early-to-mid November 2026 only explicitly registered authentication methods will satisfy SSPR (message center MC1325414, summarized in the Microsoft Entra blog). Directory attributes that used to count on their own — mobilePhone, businessPhone and otherMails, the ones Entra Connect syncs from on-prem AD — will no longer be valid for SSPR unless the user has registered them as a method.

The tickets it will generate

  • “I tried to reset my password and it says I have no methods to verify with.”
  • “Password reset worked last month, now it won’t let me use my mobile number.”
  • “Why am I suddenly being asked to register my phone again?”

These hit hybrid and Entra Connect users hardest: the phone number synced from AD was quietly doing the work, and it just stopped being enough on its own.

What to check

  • Coverage: Entra admin center → Authentication methods → User registration details. Find users with no registered method that satisfies your SSPR policy.
  • At scale: the Graph report GET /reports/authenticationMethods/userRegistrationDetails, filtered for users whose only usable method was a synced phone.
  • The real date: your own Message Center, because Microsoft’s own notice states enforcement as both 7 and 9 November. Your tenant’s date is the one that matters.

The line for the help desk

Microsoft changed how Entra password reset decides you really are you. A phone number or alternate email that came from our directory no longer counts on its own — you now have to register it yourself. Go to aka.ms/mysecurityinfo, add a phone or the Microsoft Authenticator app, and SSPR will work again. If you can’t sign in to register, contact the service desk and we’ll verify you another way.

Here’s the part I enjoy: Microsoft’s own notice can’t agree with itself. The summary says enforcement starts 9 November; the rollout schedule in the same message says 7 November. Plan for the earlier date and you’ll never be caught out by being late. — Nyx

What we have not verified. We don’t run your tenant. The dates and attribute names here are from Microsoft message center post MC1325414 and the Entra blog; the exact enforcement date is the one point Microsoft states two ways (7 versus 9 November), so treat your Message Center as the authority for your tenant.

Go deeper