Microsoft 365 Password Reset Is Changing: What to Do Now
Microsoft Entra self-service password reset (SSPR) will accept only the methods each person has registered. Phone numbers and alternate emails stored in a user's profile stop counting. If SSPR is on in your tenant, anyone without a registered method cannot reset their own password and must ask an admin.
On this page
Microsoft announced this in Message Center post MC1325414, last updated 4 August 2026. Its act-by date is 6 November 2026. Check who is ready this week.
What is changing and who it affects
Today, SSPR can verify a person using contact details held in the directory. Examples are the mobile phone, business phone and alternate email fields on the user. The person never has to register them.
After the change, only registered methods count. Microsoft says the mobilePhone, businessPhone and otherMails fields stop working for SSPR unless the user registered them. Microsoft also says about 86% of SSPR verifications already use registered methods.
Who is affected:
- Microsoft says all users, including administrators, in tenants with SSPR enabled.
- If SSPR is off for your staff, nothing changes for them.
- SSPR is a licensed feature. Microsoft's licensing page lists password reset for cloud-only users under Business Standard, Business Premium and Entra ID P1 or P2. Business Basic is not on that list.
The dates, and where Microsoft disagrees
Microsoft's own pages do not agree. Here is what each says.
- Message Center MC1325414 (updated 4 August 2026): the registration campaign starts on 5 October 2026 and enforcement begins on 7 November 2026. The act-by date is 6 November 2026. The headline and action line say 9 November 2026.
- Microsoft Learn, Prepopulate contact information for SSPR (checked 22 October 2026): SSPR accepts only registered methods from 5 October 2026. The registration campaign starts on 9 November 2026.
- Older articles, such as Petri's piece of 1 June 2026, give 6 July and 7 September. Those dates have moved.
Microsoft says the rollout runs from early to mid-November. We cannot tell which date applies to your tenant. On the Learn reading, it may already apply to you.
Check registration now. Microsoft Learn gives an enforcement date that has already passed, while the Message Center dates quoted above are later. Do not assume your tenant is safe until 6 November; check its current notice and test a non-administrator account.
Step 1: Check whether SSPR is on
- Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
- Go to Entra ID > Password reset.
- On the Properties page, read Self service password reset enabled. It shows None, Selected or All.
None means your staff are not affected. All means everyone is. Selected means one group, so check who is in it.
Check your admin accounts either way. Microsoft's documentation says administrator accounts are enabled for SSPR by default and need two methods.
Step 2: See who has no registered method
- In the Microsoft Entra admin center, go to Entra ID > Authentication methods > User registration details.
- If you cannot find it, open Activity instead and select the Registration tab.
- Look at the SSPR Enabled, SSPR Registered and SSPR Capable columns. Filter for people who are enabled but not capable.
- Check Methods registered to see what each person has. Write down the names.
Microsoft says SSPR Capable means the person has registered enough methods for your policy and is enabled to reset. That is the column to clear.
Three cautions:
- The report can lag by up to 36 hours.
- It leaves out disabled and recently deleted users.
- Microsoft says the Authentication methods activity dashboard needs Entra ID P1 or P2. If you cannot open it, go to Entra ID > Users, select a person, then Authentication methods.
Step 3: Check how many methods your policy needs
- Go to Entra ID > Password reset > Authentication methods.
- Read Number of methods required to reset. It is one or two. Microsoft says people can only reset with a method you have enabled, so check that Authenticator and email are allowed.
Microsoft recommends registering two or more methods, so people have a backup. The methods it lists for SSPR are Microsoft Authenticator notifications, OATH tokens, SMS, voice call and email.
One catch. Microsoft Authenticator, software OATH tokens and hardware OATH tokens count as a single method, so they cannot make up a pair. A good pair is the Authenticator app plus an alternate email. Avoid building the pair on a mobile number, because Microsoft-provided text and voice codes retire on 1 February 2027, including for password reset. See our guide to the SMS and voice MFA change.
Step 4: Get staff to register
- Go to Entra ID > Password reset > Registration. Set Require users to register when signing in to Yes, then save. Microsoft says people who close the prompt are asked again at every sign-in until they finish.
- Send staff a short message. Ask them to open aka.ms/mysecurityinfo, sign in and add two methods.
- Optional: go to Entra ID > Authentication methods > Registration campaign and select Edit. Set State to Microsoft managed or Enabled. This nudges people to set up Authenticator or a passkey after they sign in with multifactor authentication (MFA). Authenticator counts for password reset. A passkey is not on Microsoft's list of SSPR methods.
- Wait up to 36 hours, then repeat Step 2. Chase anyone still listed.
- Test with one ordinary account at aka.ms/sspr. Microsoft advises testing as a non-administrator.
If you are the only admin, register two methods on your own account first.
What happens to someone who is not ready
They cannot finish a password reset. Microsoft says they are prompted to register a method or contact an administrator. Microsoft Learn says they see an error page and must ask an administrator.
To reset a password for them:
- Sign in to the Microsoft 365 admin center as a password administrator.
- Go to Users > Active users and select the person.
- Select Reset password, choose an automatic or custom password, and select Reset password again.
Share the new password securely. Microsoft also suggests planning helpdesk-assisted registration for people who cannot register themselves.
How cloud365.io can help
If you would like a second pair of eyes, ask for a Microsoft 365 audit. We review sign-in and MFA settings, and can check SSPR and registration coverage at the same time. Registered sign-in methods also sit alongside the other settings in our Microsoft 365 security checklist.
Common questions
Does this affect us if we never turned on self-service password reset (SSPR)?
Not for ordinary staff. Microsoft's notice says the change applies to tenants with SSPR enabled. If the setting reads None, your staff are not affected. Microsoft's documentation says administrator accounts can use SSPR by default and need two methods. The notice does not say whether admins are covered when SSPR is off, so check your admins anyway.
Which date should we plan for?
Check registration now. The Message Center notice quoted in this guide gives an act-by date of 6 November 2026, but Microsoft Learn gives 5 October for enforcement. These dates conflict, so do not treat 6 November as a guaranteed safe deadline. Check your tenant's current notice and test a non-administrator account.
What happens to someone who has not registered a method?
Someone with no registered method cannot reset their own password. Microsoft says they are prompted to register a method or contact an administrator. An admin with the right role can set a new password. In the Microsoft 365 admin center, go to Users, then Active users, then Reset password.
Is the phone number in a user's profile enough?
No. Contact details stored on the user stop counting for self-service password reset unless the person registered them as a method. That covers mobile phone, business phone and alternate email. Staff can register the same email, or the same number, at https://aka.ms/mysecurityinfo. Microsoft recommends two or more methods. Prefer the Authenticator app plus an email, because text and voice codes retire on 1 February 2027.
