SSPR upcoming Enforcement from July 6 2026

Question

SSPR upcoming Enforcement from July 6 2026

SAGA 45

We noticed a few notifications regarding the upcoming Self-Service Password Reset (SSPR) changes effective from July 6 and would like to understand the impact in more detail.

Could you please provide information on the following:

What are the changes being introduced?
How will these changes impact the organization and users, if at all?
Is there a way to assess or identify any potential impact in our environment before the changes take effect?
What authentication methods will be supported/allowed after the change?
Are there any actions or preparations required from our side?

Please share any relevant documentation or guidance that can help us assess and prepare for these changes.

Thanks in advance for your support.

SAGA 45 Reputation points

2026-06-16T12:40:51.3866667+00:00

Hi Is there any script or way to find the accounts which requires attention ? Also how can we achive this if the no of users are more.
Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-06-25T13:22:34.45+00:00
Hello SAGA,

Yes, if you have a large number of users, you can use Microsoft Graph PowerShell to review users' authentication method registration status.

The Get-MgReportAuthenticationMethodUserRegistrationDetail cmdlet provides registration details for each user, including whether they are registered for SSPR and which authentication methods they have configured. You can export the results to CSV and review users who are not registered for SSPR or who do not have the required authentication methods configured.

Connect-MgGraph -Scopes "Reports.Read.All" Get-MgReportAuthenticationMethodUserRegistrationDetail -All | Select-Object UserPrincipalName, DisplayName, IsSsprEnabled, IsSsprRegistered, MethodsRegistered | Export-Csv "C:\Temp\AuthenticationMethodRegistration.csv" -NoTypeInformation

You can then filter the exported report based on your organization's requirements to identify users who may need to register authentication methods before enforcement.

The following article provides additional examples of using this cmdlet:

https://m365corner.com/m365-powershell/Get-MgReportAuthenticationMethodUserRegistrationDetail.html
Aung Pun 0 Reputation points

2026-06-26T05:18:38.0866667+00:00

Will ALL users who have SSPR Enabled and haven't registered get prompted to register on and after 7 July? or ALL USERS? We have SSRP targeted to a group.
Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-06-26T10:22:43.65+00:00

Hi Aung Pun,

Based on the announcement, the registration campaign applies to tenants with SSPR enabled and is intended to prompt users who have not yet registered a supported authentication method. Users who have already registered a supported method should not receive the prompt.

The announcement doesn't specifically state that the campaign is limited to the SSPR target group. It describes the impact as applying to all users (including administrators) in tenants with SSPR enabled. If Microsoft publishes additional guidance on how group-scoped SSPR affects the registration campaign, we'll be happy to share it

1 answer

Your answer

SAGA 45 Reputation points

2026-06-16T12:40:51.3866667+00:00

Hi Is there any script or way to find the accounts which requires attention ? Also how can we achive this if the no of users are more.
Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-06-25T13:22:34.45+00:00

Hello SAGA,

Yes, if you have a large number of users, you can use Microsoft Graph PowerShell to review users' authentication method registration status.

The Get-MgReportAuthenticationMethodUserRegistrationDetail cmdlet provides registration details for each user, including whether they are registered for SSPR and which authentication methods they have configured. You can export the results to CSV and review users who are not registered for SSPR or who do not have the required authentication methods configured.

Connect-MgGraph -Scopes "Reports.Read.All" Get-MgReportAuthenticationMethodUserRegistrationDetail -All | Select-Object UserPrincipalName, DisplayName, IsSsprEnabled, IsSsprRegistered, MethodsRegistered | Export-Csv "C:\Temp\AuthenticationMethodRegistration.csv" -NoTypeInformation

You can then filter the exported report based on your organization's requirements to identify users who may need to register authentication methods before enforcement.

The following article provides additional examples of using this cmdlet:

https://m365corner.com/m365-powershell/Get-MgReportAuthenticationMethodUserRegistrationDetail.html
Aung Pun 0 Reputation points

2026-06-26T05:18:38.0866667+00:00

Will ALL users who have SSPR Enabled and haven't registered get prompted to register on and after 7 July? or ALL USERS? We have SSRP targeted to a group.
Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-06-26T10:22:43.65+00:00

Hi Aung Pun,

Based on the announcement, the registration campaign applies to tenants with SSPR enabled and is intended to prompt users who have not yet registered a supported authentication method. Users who have already registered a supported method should not receive the prompt.

The announcement doesn't specifically state that the campaign is limited to the SSPR target group. It describes the impact as applying to all users (including administrators) in tenants with SSPR enabled. If Microsoft publishes additional guidance on how group-scoped SSPR affects the registration campaign, we'll be happy to share it

Answer 1

Hello SAGA,

To clarify the timeline, July 6, 2026 marks the start of a registration campaign, while enforcement is scheduled for September 7, 2026.

The change affects how users verify their identity during Self-Service Password Reset (SSPR). After enforcement, SSPR will only use authentication methods that have been registered through Microsoft Entra ID. Information stored only in user profile attributes, such as phone numbers or alternate email addresses, will no longer be accepted unless those values have been registered as authentication methods.

For most organizations, there will be no impact to users who have already registered methods such as Microsoft Authenticator, SMS, voice call, FIDO2 security keys, or passkeys. The primary impact is for users who rely on contact information stored in their profile but have not completed authentication method registration.

To prepare, we recommend reviewing authentication method registration across your tenant and identifying users who do not have any registered methods. This will help ensure they can continue using SSPR after September 7, 2026.

The supported authentication methods are not changing as part of this update. Organizations can continue to use the methods permitted by their Authentication Methods Policy; the requirement is simply that the methods be registered and managed as authentication methods.

For more information and recommended actions, please refer to the announcement below:

https://techcommunity.microsoft.com/blog/microsoft-entra-blog/microsoft-entra-id-security-updates-what-organizations-need-to-do-now/4522024