How to disable SSPR for specific users?

Question

We have 3 computers that share a Microsoft 365 account. While replacing one of the 3 computers, Microsoft asks for "More information required ... Your organization needs more information to keep your account secure" and then requests that I verify the identity. How do I disable this verification of identity for these specific computers?

Our organization has MFA disabled by default, but we have SSPR enabled for all accounts. I believe the SSPR is causing the issue, but I really don't know. Is there a way to disable SSPR for specific accounts? Can I setup a group and set this as a policy?

I have another 140 something user accounts, that work just fine with SSPR and MFA (as needed), but these 3 computers are the only ones that share Microsoft 365 accounts.

Any help would be appreciated.

Answer 1

SSPR is configured per user, the computer/device does not matter here. In addition, there is no functionality to directly exclude a user from SSPR requirements. Instead, you need to do it the other way around - define a group on members of which the SSPR requirements will be enforced, and do not add the user(s) you want to exclude as members of the group.

The process isn't very flexible, as only a single group can be specified, and only in "include" mode, but it should be sufficient to address your scenario. Details are here if you need them: https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr#enable-self-service-password-reset