Users Can’t Reset Their Password in Entra: SSPR Fix

Staff who never registered a phone or app for password reset will hit a dead end in November. Find them in five minutes.

If staff suddenly cannot reset their own Microsoft 365 password, the cause is a Microsoft Entra change rolling out in early November 2026. Self-service password reset now only accepts verification methods each user registered themselves. Phone numbers or email addresses that sit on the user’s profile, typed in by an admin or synced from Active Directory, no longer count. The fix is getting every user to register a method at aka.ms/mysecurityinfo.

For owners: anyone who skipped registration can no longer reset a forgotten password on their own and has to call whoever runs your IT. The list of who is affected takes about five minutes to pull, so ask for it now.

What Microsoft Changed

Until now, self-service password reset could text a code to the mobile number on a user’s profile or email their alternate address, even if the user never set those up as sign-in methods. Microsoft is closing that path as part of its Secure Future Initiative, announced in message center post MC1325414.

A registration campaign started October 5, 2026, prompting users who do not have enough methods. Enforcement begins in early November, with the message center post giving November 7 in its schedule and November 9 in its title, and rolls out through mid-November. It applies to every user in a tenant with self-service password reset turned on, admins included.

Hybrid tenants are the most exposed. Entra Connect copies the telephoneNumber and mobile fields from on-premises Active Directory into the Office phone and Mobile phone fields, and many people never registered anything beyond that.

Find Users Who Will Be Locked Out

In the Microsoft Entra admin center, open Entra ID, then Authentication methods, then Activity, and select User registration details. Filter SSPR Registered to Not Registered. Everyone on that list is at risk. Check the SSPR Capable column as well: Not Capable means the user does not have enough methods to satisfy your reset policy.

The report can lag by up to 36 hours, and it skips disabled and recently deleted accounts, so a user who registers today may still show as Not Registered tomorrow.

For a list you can export, the Microsoft Graph PowerShell module does the same thing. It needs the AuditLog.Read.All permission and an account with Reports Reader, Security Reader, Security Administrator or Global Reader:

Install-Module Microsoft.Graph.Reports -Scope CurrentUser
Connect-MgGraph -Scopes "AuditLog.Read.All"

Get-MgReportAuthenticationMethodUserRegistrationDetail -All -Filter "isSsprRegistered eq false" |
  Where-Object { $_.UserType -eq "member" } |
  Select-Object UserPrincipalName, IsSsprEnabled, IsSsprCapable, @{n="Methods";e={$_.MethodsRegistered -join ", "}} |
  Export-Csv .\sspr-not-registered.csv -NoTypeInformation

Get Them Registered

Send the list a short message with one link: aka.ms/mysecurityinfo. Users sign in, choose Add sign-in method, and add the Microsoft Authenticator app or a phone number they verify with a code. Two methods is a sensible minimum so a lost phone does not lock someone out.

Shared mailboxes and service accounts usually should not use self-service reset at all. Exclude them from the SSPR scope instead of registering a personal phone to them.

If someone gets locked out before they register, an admin can still reset the password in the Microsoft 365 admin center or the Entra admin center as before. Only the self-service path changes.

Forward This to IT

Three things to ask your IT person or provider. Has the User registration details report been checked for Not Registered users? Have those users been sent to aka.ms/mysecurityinfo? Are shared and service accounts excluded from self-service reset?

If a user locks their account with too many wrong passwords while sorting this out, our guide to sign-in error code 50053 shows how to get the account back.