Self-service password reset (SSPR): after Entra SMS and voice MFA retire
Short answer: The retirement of Microsoft-provided SMS and voice applies to SSPR as well, unless you configure a telephony provider through Microsoft Security Store. Passkeys, Windows Hello for Business and TAP can't be used for SSPR, so users need another SSPR method such as Microsoft Authenticator notifications, OATH tokens or email OTP. Security questions are also being retired for SSPR in March 2027.
Deadline: Microsoft stops sending Entra ID MFA codes by SMS and voice call on 1 February 2027 (Global Administrators and external users: 1 July 2027). Users whose only MFA method is SMS or voice then have to register a passkey at sign-in before they can continue, and there is no opt-out from that step.
Options
| Method | Phishing-resistant | Best for | Watch out |
|---|---|---|---|
| Microsoft Authenticator push notification | no | Users who already have Authenticator. | Authenticator, software OATH and hardware OATH tokens count as one SSPR method, and Authenticator can't be the only method when one is required. |
| Software or hardware OATH token | no | Users without push, including users with no smartphone (hardware token). | Counts as the same method as Authenticator when two methods are required. Hardware OATH tokens are in preview. |
| Email OTP | no | A second SSPR method for tenant members that doesn't use a phone. | For members it is an SSPR method, not a sign-in or MFA method. |
| Security questions | no | Legacy only. | Retired for SSPR in March 2027, and admin accounts can't use them. |
| SMS, voice or office phone through a telephony provider | no | Only if you configure a telephony provider through Microsoft Security Store. | Office phone verification is also an automated voice call. |
What to do
- Review your SSPR policy: how many methods are required (one or two) and which methods are enabled.
- Enable at least one SSPR method that doesn't use SMS or voice: Microsoft Authenticator, software or hardware OATH tokens, or email OTP. If two methods are required, don't count Authenticator plus an OATH token as two.
- Turn on Require users to register when signing in so users add the new methods at their next sign-in.
- Move users off security questions before March 2027 and set them up with supported methods in the Authentication methods policy.
- Test password reset with an account that has no admin role. Admin accounts use a separate two-gate policy that you can't change.
- For passwordless users, watch for the password change support Microsoft plans for users who sign in passwordless; details aren't published yet.
Watch out
- If you change the enabled methods, users who don't have data for the new set can't use SSPR until they register.
- A user whose only registered method is a passkey can't use it to reset their password.
- The admin two-gate policy doesn't depend on the Authentication methods policy and doesn't allow security questions.
- B2B users from another Microsoft Entra tenant reset under their home tenant's SSPR policy. Microsoft accounts with guest access can't use Microsoft Entra SSPR.
Which users are SMS-only today? Find them in the admin center or with one PowerShell command.
Sources
- Microsoft Learn: FAQ for Microsoft-provided SMS and voice retirement
- Microsoft Learn: Self-service password reset deep dive
- Microsoft Learn: Self-service password reset policies
- Microsoft Learn: Security questions authentication method
- Microsoft Learn: Microsoft Entra authentication overview
- Microsoft Learn: Voice call authentication method
Other situations
- Users without a smartphone
- Shared and kiosk Windows PCs
- Frontline workers and shared mobile devices
- B2B guests and internal guest users
- FIDO2 security keys and passkey profiles
- Windows Hello for Business and Entra passkey on Windows
- Passkeys in Microsoft Authenticator
- Break-glass accounts and Global Administrators