If your staff reset their own Microsoft 365 passwords, you have until November 7 to make sure they can still do it. On that date Entra ID stops accepting the phone number and email address sitting in a user's directory profile as proof of identity. Only methods the user has deliberately registered will count. Anyone who hasn't registered one loses self-service reset and has to call you instead.
By Latoya Reed, The NetSys Group
What exactly is changing?
Today, self-service password reset can fall back on contact details an admin typed into a user's profile years ago. After the cutoff it can't. Microsoft's Message Center post MC1325414 is direct about it: directory attributes such as mobile phone, business phone, and alternate email stop being valid for SSPR unless the user has registered them as authentication methods.
The distinction is easy to miss. A mobile number in a user's profile is directory data; the same number becomes an authentication method only when the user walks through registration and confirms it. Microsoft's position is that a method the user validated is harder to spoof than a field an administrator filled in.
It applies to every tenant with SSPR turned on, in the public cloud and the US Government clouds.
When is the deadline, really?
November 7, 2026 is the enforcement date, and Microsoft's own registration campaign starts October 5. That timeline was revised in August, moving enforcement from early September to early November, as recorded in the MC1325414 rollout timeline. You have about six weeks, not zero.
Check that against what you may have read. The original announcement put enforcement in early-to-mid September, Microsoft revised the timeline in August, and plenty of write-ups published this summer still carry the old September date. If you saw a September headline and assumed you'd already missed it, you haven't.
What happens to a user who isn't registered?
They can't reset their own password. They'll get prompted to register a method or told to contact an administrator, which means your help desk absorbs every one of those resets.
That's the part worth planning for. A locked-out user on a Monday morning is a ticket, a phone call, and fifteen minutes of someone's time. Multiply by however many people never got around to registering.
How do you find out who's exposed?
Start in the Entra admin center under authentication methods, where the registration report shows coverage across your tenant. For a straight list of the people who'll break, Microsoft Graph PowerShell gives you one:
Get-MgReportAuthenticationMethodUserRegistrationDetail -All -Filter "isSsprEnabled eq true and IsSsprRegistered eq false"
Run it, and you have your remediation list. In most small tenants it's a short one, and it's almost always the same cast: the owner who never finished setup, a shared mailbox nobody thought about, the field staff who rarely sign in on a browser.
What should you do before November 7?
Four things, in order.
- Pull the list. You can't fix what you haven't counted, and the number is usually smaller than people fear.
- Turn on the registration campaign. It nudges users to register at sign-in instead of relying on an email nobody reads. Microsoft starts its own campaign October 5; there's no reason to wait for it.
- Check your SSPR policy matches. If your policy demands two methods, one registered method won't clear the bar. Confirm what you require and what people actually have.
- Decide how the stragglers get helped. Some users won't register no matter how many prompts they get. Plan the assisted path now, and read the next section before you do.
The part most write-ups skip
Pushing everyone toward the help desk creates a different problem. Attackers already call IT pretending to be locked-out employees, and a reset request is exactly the moment your team is most inclined to be helpful.
So if this change routes more password resets through a human, tighten how that human confirms who's calling. We cover the verification steps in how attackers talk your help desk into a password reset.
Better still, move people toward stronger methods while you have their attention. If you're asking staff to register something anyway, an authenticator app or a passkey beats an SMS code, and the registration prompt is the cheapest moment you'll ever get to make that switch. Our comparison of passkeys and traditional MFA covers which method to push.
Does this change what you're licensed for?
No, but it's worth knowing where you stand. Per Microsoft's SSPR licensing documentation, self-service reset for cloud-only users comes with Microsoft 365 Business Standard and above, or Entra ID P1 and P2. The free Entra tier allows password changes, not resets.
Writeback to on-premises Active Directory is stricter: it needs Entra ID P1 or P2, or Microsoft 365 Business Premium. So if you still run a domain controller and want cloud resets to reach it, Business Standard won't do it. Our breakdown of Entra ID P1 versus P2 sorts out the rest.
Frequently asked questions
Do I need to do anything if we don't use SSPR?
No. The change only affects tenants with self-service password reset enabled. If your users always call IT for resets, nothing breaks on November 7. It's still worth asking why you're absorbing that work by hand, since SSPR is already included in Microsoft 365 Business Standard and above.
Will already-registered users be affected?
No. Anyone who has registered an authentication method through the normal prompts keeps working exactly as before. The change only bites accounts that were relying on directory attributes an admin entered, which is why the fix is registration coverage rather than a configuration change.
What counts as a registered method?
Anything the user confirmed during registration: the Microsoft Authenticator app, a passkey, an SMS code to a number they verified, a voice call, or an email one-time passcode. The test isn't what the method is. It's whether the user validated it rather than an administrator typing it into a profile field.
Can we just turn SSPR off to avoid this?
You can, and it's the wrong trade. Every reset then becomes a help desk ticket, and a human-handled reset is the softer target of the two. Getting registration coverage up is less work than absorbing the call volume.
How long does registration take a user?
About a minute with the Authenticator app already installed, a few minutes without. The friction is getting people to do it at all, which is what the registration campaign is for.
Want the exposed-user list pulled and the registration campaign configured before the deadline? Book a complimentary assessment, or see how we handle Microsoft 365 management day to day.
The NetSys Group has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, serving businesses across NY, NJ, CT, PA, and Southwest Florida.
Discuss microsoft 365 management & backup for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.