SSPR (Self Service Password Request) will require registered authentication methods (Effective September 7, 2026)
Microsoft continues to evolve its identity and access management platform, and one of the most impactful changes coming in 2026 affects Self-Service Password Reset (SSPR).
Organizations must prepare for a key enforcement milestone:
Starting September 7, 2026, users will only be able to use SSPR if they have registered the required authentication methods in Microsoft Entra ID. This change aligns with Microsoft’s broader push toward modern authentication, Zero Trust security, and unified identity management.
Understanding the Change
SSPR has always relied on users verifying their identity using authentication methods such as:
- Microsoft Authenticator app.
- Mobile phone (SMS or voice).
- Email.
- FIDO2 keys or passwordless methods.
However, with the modernization of Entra ID:
- Microsoft retired legacy MFA and SSPR policy management on September 30, 2025.
- All authentication methods are now centrally managed through the Authentication Methods policy.
- Users must be registered with sufficient authentication methods to complete SSPR successfully.
The 2026 enforcement ensures that registration is no longer optional or loosely enforced—it becomes mandatory for SSPR usage.
What Happens on September 7, 2026?
From this date onward:
Users with registered methods
- Can reset their password using SSPR without issues.
- Must meet the organization’s configured policy (e.g., 1 or 2 methods).
Users without registered methods
- Cannot reset their password using SSPR.
- Will be redirected to IT helpdesk support.
- May experience account lockout delays and productivity loss.
This is because SSPR explicitly checks whether:
- The user is enabled for SSPR.
- The user has enough registered authentication methods to satisfy policy requirements.
Why Microsoft is Enforcing This
This change is not just administrative—it’s rooted in security and usability improvements:
Stronger Identity Verification
Requiring registered methods ensures that password resets are performed only by verified users, reducing the risk of unauthorized access.
Alignment with Zero Trust Principles
Modern security assumes breach and enforces. Multi-factor verification for Identity validation before critical actions like password reset.
Reduced Helpdesk Dependency
When users are properly registered:
- Password resets become self-service.
- Organizations see reduced IT workload and faster recovery times.
The Role of Combined Registration
Microsoft introduced combined security information registration, which:
- Allows users to register once for both MFA and SSPR.
- Eliminates duplicate registration processes.
- Ensures a consistent user experience.
This means:
If a user registers for MFA properly, they are also prepared for SSPR—provided SSPR is enabled and methods meet policy requirements.
Key Risks If You Don’t Prepare
Organizations that fail to enforce registration before the deadline may face:
- User lockouts due to missing authentication methods.
- Admin lockouts if privileged accounts are not properly configured.
- Increased helpdesk tickets and operational disruption.
- Compliance and audit risks due to weak identity controls.
How to Prepare Before September 7, 2026
Here’s a practical checklist for IT administrators:
1. Enable and Enforce Registration
- Require users to register authentication methods at sign-in.
- Set registration campaigns and reminders.
2. Define Authentication Method Policies
- Configure allowed methods (Authenticator, SMS, FIDO2, etc.).
- Assign policies to appropriate user groups.
3. Require Multiple Methods
Increase security by requiring at least two methods for SSPR where possible.
4. Monitor Registration Status
Use Authentication Methods Activity reports to track:
- Registered users.
- SSPR-capable users.
5. Secure Administrator Accounts
Ensure all admins:
- Have multiple authentication methods.
- Are included in policies.
6. Communicate with End Users
- Run awareness campaigns.
- Provide clear instructions for registering methods.
Conclusion
The September 7, 2026 enforcement is a natural next step in Microsoft’s identity modernization journey. After consolidating authentication policies and retiring legacy configurations, Microsoft is now ensuring that:
SSPR is only accessible to users who are truly ready—by having verified, secure authentication methods in place.
For organizations, the message is simple:
- Register users early.
- Enforce modern authentication.
- Monitor continuously.
Failing to act could mean locked-out users and overwhelmed support teams, while proper preparation enables a secure, seamless self-service experience.
Our Microsoft office 365 Implementation services team are here if you have any questions or require support on this change.