Starting November 9, 2026, Microsoft Entra ID will only accept password reset verification from methods a user actually registered, like a phone number set up through My Security Info or an authenticator app. Directory fields an admin typed into a user’s profile years ago, such as a mobile number that was never formally registered, no longer count. If your company runs Microsoft 365 with Entra ID (what used to be called Azure AD), this is worth five minutes of your IT team’s time this week.
- Entra ID self-service password reset (SSPR) now requires a registered authentication method, not just a directory-listed phone number or email.
- Microsoft says roughly 86% of resets already use registered methods, so most companies have a small gap, not a large one.
- Employees with no registered method will be unable to reset their own password and will need an admin or help desk ticket instead.
- Checking registration coverage takes about five minutes in the Microsoft Entra admin center.
- This pairs with the shift toward passkeys and stronger sign-in methods Microsoft has been pushing across Microsoft 365 all year.
What is actually changing in Entra ID?
Until now, Entra ID’s self-service password reset could verify a user’s identity two ways: through an authentication method the user set up themselves, or through a contact value stored as a plain attribute on their account in the directory, like a phone number HR entered when the account was created. Microsoft’s own Message Center notice MC1325414 confirms the second path is going away on November 9, 2026. From that date on, only methods a person has explicitly registered through My Security Info, such as a verified phone number, an authenticator app, or an email set up for that purpose, will satisfy a reset request.
Microsoft frames this as part of its broader Secure Future Initiative, the same push that made passkeys the default sign-in prompt earlier this year. We covered that shift in our look at Microsoft 365 passkeys going default, and this follows the same logic: stop trusting information Microsoft stored on a person’s behalf, and start trusting only what that person actively proved they control.
Why should a small Boston business care?
Most companies in the 10 to 150 employee range we work with never think about SSPR until someone is locked out on a Monday morning before a client call. Once the directory shortcut disappears, an unregistered employee gets an error message instead of a reset link, and the ticket lands on whoever answers your help desk line. A support process that can’t verify someone through self-service often gets replaced, informally, with a phone call where identity gets confirmed by voice recognition and little else, exactly the kind of gap attackers count on.
Who is likely to be affected at your company?
Three groups tend to show up on the unregistered list every time we run this check for a client: employees hired before SSPR registration was enforced at onboarding, part-time or seasonal staff whose accounts were provisioned quickly, and admin or service accounts with no person sitting at that desk to walk through a registration flow. That last group matters most, since an admin account that can’t self-reset often ends up with a shared password written down somewhere, which is its own separate problem.
How do you check your own tenant before this bites you?
An administrator with the right role can sign into the Microsoft Entra admin center, open Authentication methods, then User registration details, and sort by registered methods. Anyone showing zero is a problem to fix now rather than after they call in locked out. Microsoft’s own guidance, summarized in coverage from Petri, recommends turning on the built-in SSPR registration campaign so affected users get prompted automatically at sign-in, plus having a documented help-desk-assisted registration process for anyone who can’t finish it alone.
Frequently asked questions
What exactly changed with Entra ID password reset on November 9, 2026?
Self-service password reset in Microsoft Entra ID now only accepts verification methods a user has explicitly registered, such as a phone number or app set up through My Security Info. Phone numbers or email addresses that exist only as directory fields, meaning an admin entered them in a user’s profile but the user never registered them, no longer count as proof of identity for a reset.
Will this lock employees out of Microsoft 365 right away?
Not automatically, but anyone who has never completed authentication method registration will hit a wall the next time they try to reset a forgotten password. Microsoft says about 86 percent of password resets already use registered methods, so most organizations have a smaller gap than they expect, but the remaining share needs attention before it causes a support call.
Does this apply to Microsoft 365 Business Premium and Standard, or only enterprise tenants?
It applies to any tenant with Entra ID (formerly Azure AD) and self-service password reset turned on, which includes Microsoft 365 Business Premium, Business Standard with Entra ID P1, and most nonprofit and education tenants. If your staff sign into Outlook, Teams, or SharePoint with a work account, this change reaches you.
How do we check who in our company is affected?
An administrator can open the Microsoft Entra admin center, go to Authentication methods, then User registration details, and filter for users with zero registered methods. That list is your action item. Boston Managed IT can run this check for you as part of a free review if you don’t have admin access handy.
If you don’t know whether your company’s Entra ID tenant has this gap, that uncertainty is the real risk here, not the change itself. A locked-out employee on a Friday afternoon is a minor headache; a service account or finance team member stuck outside the system during a busy week is not. Boston Managed IT will run a free 15-minute Microsoft 365 security review and tell you exactly who in your organization is unregistered and what to do about it, no obligation attached. Call (617) 322-5155 or set up a time at bostonmit.com/contact.
— Boston Managed IT
