Microsoft SSPR Changes: What Are Your Options?

Microsoft is phasing out SMS, voice and security questions as native authentication and password recovery methods in Microsoft Entra ID, pushing organizations towards phishing-resistant alternatives.

Passkeys are now the default option for authentication, but the main changes begin on February 1, 2027, when Microsoft-provided SMS and voice authentication will be retired for most users. Security questions will follow in March 2027, removing another long-standing option from self-service password reset (SSPR).

While the move aims to strengthen identity security, it also creates challenges for organizations with employees who cannot easily use the supported methods. Businesses relying on traditional verification methods must now rethink how employees authenticate and reset passwords.

How Organizations Can Retain Flexible Password Resets

For desk-based employees, moving to the supported multi-factor authentication (MFA) and SSPR should be relatively straightforward. But for…