Microsoft drops directory phone numbers from SSPR in November

From early November 2026, Entra self-service password reset will only accept authentication methods users registered themselves. Phone numbers and alternate emails stored in the directory (mobilePhone, businessPhones, otherMails) will no longer count, administrators included. Microsoft advises tenants to prepare by 6 November.

• SSPR will verify only explicitly registered authentication methods
• Directory attributes mobilePhone, businessPhones and otherMails stop working
• Change affects all users with SSPR enabled, administrators included
• Registration campaign starts 5 October, enforcement from 7 November 2026