Invaild_grant error after enable SSPR

Question

Good morning,

Due to the upcoming retirement of SMS and Voice authentication, we started looking for an alternative approach for SSPR, while still maintaining the requirement for two authentication methods for password reset.

We decided to use:

• Microsoft Authenticator
• Email OTP

(Please don't blame me for the Email OTP choice 😄)

current situation:

• Hybrid identities synchronized from on-premises Active Directory.
• An on-premises universal security group synchronized to Entra ID and configured as the SSPR-enabled group. The group contains users from two different AD domains.
• Very restrictive Conditional Access policies. Nearly all applications require a Hybrid Entra Joined device, with only a few exclusions.
• A large population of users who do not have access to Hybrid Entra Joined devices.
• Migration status from legacy authentication methods: Not** **Started.
• Registration campaign: Disabled.
• Test user from Domain** B has no registered authentication methods when accessing the My **Sign-Ins portal.
• Test user from Domain** **B has the following methods enabled at the tenant level, just like users from both domains:
  • Hardware OATH
  • Software OATH
  • Microsoft Authenticator
  • Password
  • Voice
  • SMS

What are we doing?

Our goal is to allow users to access the My** **Sign-Ins portal and register authentication methods before enabling SSPR.

I configured Conditional Access according to the Office 365 IT Pros article regarding access to the registration portals. The configuration works perfectly until I add the user to the SSPR-enabled security group.

Once the user is added to the SSPR group, access to the portal fails with an invalid_grant error (screenshot attached).

If I remove the user from the SSPR group, the portal becomes accessible again. The user is not prompted to register methods, which is acceptable for now, but we plan to roll out SSPR in the near future.

Additional topic, do not know if it is combined.

I also occasionally receive the following error:

The Authentication Agent is unable to validate the user's password. Check the agent logs for more information and verify that Active Directory is operating as expected.

This appears mostly for users from Domain** **B.

We have four Pass-through Authentication (PTA) agents deployed. From what I can see, PTA is functioning correctly. I also validated the PTA configuration using Microsoft's recommended PowerShell cmdlets, and authentication tests completed successfully.

what did I do?

• A user from Domain** **A was not affected after being added to the SSPR group.
• Users from Domain** **B consistently experience the issue after being added to the SSPR group.
• Assigned EMS licenses to Domain B users without success.
• Tested the Conditional Access User** Action → Register security **information policy separately.
• Tested grant controls requiring MFA and verified membership conditions.
• No improvement in any of the above scenarios.

questions:

Has anyone seen similar behavior where:

1. Adding a user to an SSPR-enabled group causes invalid_grant when accessing My Sign-Ins?
2. The issue affects users from only one synchronized AD domain?
3. PTA reports password validation errors even though the PTA health checks and authentication tests are successful?

Do you have any recommendations on what I should investigate next, especially regarding the Domain B-specific behavior?

Any advice would be greatly appreciated.

Thank you