Microsoft Entra ID will require registered authentication methods for password resets from September 2026, strengthening identity security and access control.

Microsoft is introducing a major security update to its platform, Microsoft Entra ID. From September 7, 2026, users will only be able to reset their passwords through Self-Service Password Reset (SSPR) using authentication methods that have been already registered and verified in advance. Microsoft Entra ID password reset rules is part of Microsoft's broader effort to strengthen account security and reduce the risk of unauthorized access.

Registered authentication will become mandatory

Currently, Entra ID users can sometimes verify their identity using contact information stored in the directory, such as:

  • Mobile phone numbers

  • Work phone numbers

  • Alternate email addresses

Even if these details have not been registered as authentication methods, they may still be accepted during password recovery. That flexibility will end in September 2026.

Under the new policy, only authentication methods that users have formally registered and validated will be accepted for password resets. Contact information that exists only as a directory attribute will no longer be enough.

Why is microsoft making this change

Password recovery is often one of the most targeted areas for cyberattacks. Old phone numbers, outdated email addresses, and unmanaged contact information can become security weaknesses if they remain attached to user accounts.

By requiring verified authentication methods, Microsoft aims to ensure that password recovery relies only on trusted identity verification channels. To prepare organizations for the change, Microsoft will launch a registration campaign on July 6, 2026.

Users who have not yet registered an authentication method will receive prompts encouraging them to do so before enforcement begins.

Starting September 7:

  • Unregistered methods will no longer work for SSPR.

  • Users without a registered method will be unable to reset passwords on their own.

  • Affected users will need to register an authentication method or seek help from IT administrators.

Most users are already prepared. Microsoft says approximately 86% of Entra ID users who currently use SSPR already rely on registered authentication methods.

What Should IT Teams Do Now

Organizations are being encouraged to review authentication coverage through the Entra admin center and identify users who have not completed registration. Accounts with administrator privileges require special attention. If administrators lack registered authentication methods, they could face account recovery challenges after the policy takes effect.

Microsoft also recommends creating emergency account recovery procedures for users who become locked out.

Part of Microsoft's Secure Future Initiative

Microsoft major change impact on administration, compliance, and user processes. The new requirement is part of the company's Secure Future Initiative (SFI), a long-term cybersecurity program designed to strengthen defenses across Microsoft products and services.

As Entra ID serves as the gateway to cloud applications, company data, single sign-on (SSO), multi-factor authentication (MFA), and access controls, securing password recovery has become a critical priority.

As Business Fortune observes, the latest update reflects a growing industry shift toward stronger identity verification and reduced reliance on passive account information. As cyber threats continue to evolve, organizations can expect identity systems to place greater emphasis on verified authentication methods, continuous validation, and zero-trust security principles. Microsoft's move may signal a future where account recovery becomes just as secure as the login process itself.