If your staff reset their own Microsoft 365 passwords, you have until November 7 to make sure they still can. On that date Entra ID stops accepting the phone number and email address sitting in a user's directory profile as proof of identity. Anyone who hasn't registered a method loses self-service reset and calls you instead.
By Latoya Reed, The NetSys Group
What exactly is changing?
Self-service password reset (SSPR) can no longer fall back on contact details an admin typed into a profile years ago. Microsoft's Message Center post MC1325414 says it directly: mobile phone, business phone, and alternate email stop counting for SSPR unless the user registered them as authentication methods.
The distinction is easy to miss. A mobile number in a profile is directory data. It becomes an authentication method only when the user walks through registration and confirms it.
It applies to every tenant with SSPR turned on, in the public cloud and the US Government clouds.
When is the deadline, really?
Plan for November 7, 2026. That's the enforcement date in Microsoft's rollout schedule, and Microsoft's registration campaign already started prompting users on October 5.
One wrinkle: the same Message Center post also tells admins to act "before November 9, 2026." Don't bet on the later date. Two extra days won't save you, and finishing by November 7 covers both readings.
If you saw a September date this summer, that's the old timeline. Microsoft moved enforcement to November in its August 4 update, and plenty of write-ups never caught up.
What happens to a user who isn't registered?
They can't reset their own password. They'll be prompted to register a method or told to contact an administrator, so your help desk absorbs every one of those resets.
Plan for that. A locked-out user on a Monday morning is a ticket, a phone call, and fifteen minutes of someone's time, multiplied by everyone who never registered.
How do you find out who's exposed?
Start in the Entra admin center under authentication methods, where the registration report shows coverage across your tenant. For a straight list of the people who'll break, run this in Microsoft Graph PowerShell:
Get-MgReportAuthenticationMethodUserRegistrationDetail -All -Filter "isSsprEnabled eq true and IsSsprRegistered eq false"
That's your remediation list. In most small tenants it's short, and it's usually the same cast: the owner who never finished setup, a shared account nobody thought about, field staff who rarely sign in on a browser.
What should you do before November 7?
Four things, in order.
- Pull the list. You can't fix what you haven't counted, and the number is usually smaller than people fear.
- Turn on your own registration campaign. Microsoft's started October 5, but configuring yours lets you control the prompt, the snooze limit, and who's targeted.
- Check your SSPR policy matches. If your policy demands two methods, one registered method won't clear the bar. Confirm what you require against what people actually have.
- Decide how the stragglers get helped. Some users won't register no matter how many prompts they see. Plan the assisted path now, and read the next section first.
The part most write-ups skip
Pushing everyone toward the help desk creates a different problem. Attackers already call IT pretending to be locked-out employees, and a reset request is exactly when your team is most inclined to help.
If this change routes more resets through a human, tighten how that human confirms who's calling. We cover the verification steps in how attackers talk your help desk into a password reset.
Better still, move people to stronger methods while you have their attention. An authenticator app or a passkey beats an SMS code, and this registration push is the cheapest moment you'll get to make the switch. Our comparison of passkeys and traditional MFA covers which method to push, and our note on Microsoft retiring SMS and voice MFA explains why SMS is a dead end anyway.
Does this change what you're licensed for?
No. Per Microsoft's SSPR licensing documentation, self-service reset for cloud-only users comes with Microsoft 365 Business Standard and above, or Entra ID P1 and P2. The free Entra tier allows password changes, not resets.
Writeback to on-premises Active Directory is stricter: it needs Entra ID P1 or P2, or Microsoft 365 Business Premium. If you still run a domain controller and want cloud resets to reach it, Business Standard won't do it. Our breakdown of Entra ID P1 versus P2 sorts out the rest.
Frequently asked questions
Do I need to do anything if we don't use SSPR?
No. The change only affects tenants with self-service password reset enabled, so if your users always call IT for resets, nothing breaks on November 7. It's still worth asking why you're doing that work by hand, since SSPR comes with Business Standard and above.
Is the deadline November 7 or November 9?
Microsoft's post lists both: November 7 as the day enforcement begins, and November 9 in its "act before" language. Treat November 7 as the real deadline. Finishing registration by then covers you either way, and nothing about the fix gets easier with two more days.
Will already-registered users be affected?
No. Anyone who registered a method through the normal prompts keeps working exactly as before. The change only hits accounts relying on directory attributes an admin entered, which is why the fix is registration coverage, not a configuration change.
What counts as a registered method?
Anything the user confirmed during registration: the Microsoft Authenticator app, a passkey, an SMS code to a number they verified, a voice call, or an email one-time passcode. The test isn't what the method is. It's whether the user validated it, rather than an admin typing it into a profile field.
Can we just turn SSPR off to avoid this?
You can, and it's the wrong trade. Every reset becomes a help desk ticket, and a human-handled reset is the softer target of the two. Getting registration coverage up is less work than absorbing the call volume.
How long does registration take a user?
About a minute with the Authenticator app already installed, a few minutes without. The hard part is getting people to do it at all, which is what the registration campaign is for.
Want the exposed-user list pulled and the registration campaign configured before November 7? Book a complimentary assessment, or see how we handle Microsoft 365 management day to day.
The NetSys Group has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, serving businesses across NY, NJ, CT, PA, and Southwest Florida.
Discuss microsoft 365 management & backup for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.