# Microsoft Entra ID Authentication Methods — SSPR, Password Protection & Combined Registration Source: https://ai.techclick.in/blog_microsoft_entra_authentication_methods Markdown: https://ai.techclick.in/blog_microsoft_entra_authentication_methods.md Publisher: Techclick Infosec Pvt Ltd Master Microsoft Entra ID authentication methods in 2026: auth-methods policy, SSPR, password protection, smart lockout, and combined registration — fully explained with real scenarios. Microsoft Entra ID Authentication Methods — SSPR, Password Protection & Combined Registration student learning map A visual study map for Microsoft Entra ID Authentication Methods — SSPR, Password Protection & Combined Registration showing learning path, evidence, traps, and practice sequence. TECHCLICK STUDY MAP Microsoft Entra ID Authentication Methods — SSPR,... Microsoft · learn the flow, prove with evidence, avoid unsafe shortcuts 1. Start 🎯 By the end you will be able to 2. Understand Pick where you want to start 3. Prove ① The authentication-methods... 4. Practice ② SSPR — scope, gates, methods and... How to use this page First build the mental model, then connect the concept to a realistic production decision. Finish by testing yourself. Techclick Infosec Pvt Ltd | ai.techclick.in | Training Contact: WhatsApp +91 92772 29456 Content-specific feature visual for this lesson: use it as the 60-second map before reading the full detail. Most engineers think… Most people treat MFA, SSPR and passwordless as three separate configuration screens. That mental model creates gaps — users get prompted to register twice, or lose SSPR access because a phone number stored in Active Directory never became a registered authentication method. Microsoft Entra ID has one authentication-methods policy that is the single source of truth for every factor. Methods you enable there flow into MFA challenges, SSPR gates and passwordless sign-in simultaneously. The combined registration experience surfaces them to users in one unified flow. Getting the policy right — and understanding the September 2026 SSPR enforcement change — is what separates a working identity deployment from a help-desk flood. ## ① The authentication-methods policy — one control plane for every factor The authentication-methods policy (Entra admin centre ▸ Protection ▸ Authentication methods) is the single place you enable or disable each credential type: passkeys (FIDO2) , Microsoft Authenticator (push notifications + passwordless phone sign-in), OATH hardware/software TOTP tokens , SMS , Voice call , Email OTP , Temporary Access Pass (TAP) and Certificate-Based Authentication (CBA) . Each method can be targeted to all users or to specific include/exclude groups , so you can roll out passkeys to a pilot group before enabling them tenant-wide. The policy feeds three use-cases simultaneously. When a user is challenged for MFA , Entra offers only the methods the policy allows and the user has registered. When a user starts an SSPR flow, only policy-allowed and explicitly registered methods appear as reset options. When a user enrols for passwordless , the same policy governs which credentials they can add. Writing the policy correctly once prevents users hitting dead ends across all three flows. Figure 1 — One auth-methods policy, three use-cases Every method you enable in the authentication-methods policy flows into MFA, SSPR and passwordless simultaneously — target by group for staged rollouts. - One auth-methods policy, three use-cases Auth Methods Policy (per group) MFA challenges SSPR gates Passwordless TAP onboarding Every method you enable in the authentication-methods policy flows into MFA, SSPR and passwordless simultaneously — target by group for staged rollouts. Quick check · Q1 of 10 · Understand Where do you enable Microsoft Authenticator push notifications as an MFA method in Entra ID? a) Conditional Access ▸ Grant controls b) Security defaults toggle in the tenant overview c) Authentication methods policy — enable Microsoft Authenticator and target the relevant group d) Each user's profile page individually Correct: c. The authentication-methods policy (Protection ▸ Authentication methods) is the single place to enable or disable each credential type, with per-group targeting for all three use-cases (MFA, SSPR, passwordless). 👉 So far: The authentication-methods policy is the single control plane — enable a method there and it flows into MFA challenges, SSPR gates and passwordless enrolment simultaneously, with per-group targeting. ## ② SSPR — scope, gates, methods and the 2026 enforcement change SSPR is enabled at Entra admin centre ▸ Protection ▸ Password reset . The scope can be set to None, a selected group, or All users. The number of methods required to reset is 1 or 2 — Microsoft recommends 2 for higher assurance. Allowed reset methods draw from the authentication-methods policy: Authenticator app notification, Authenticator app code, Email, Mobile phone SMS, Mobile phone call, Office phone, and Security questions (for cloud-only accounts). ### The September 2026 enforcement change Until now, SSPR could accept contact information stored in directory attributes — a mobilePhone or otherMail value added by HR sync — even if that value was never explicitly registered as an authentication method. Starting September 7, 2026 , SSPR will accept only methods the user (or an admin) has explicitly registered in their security-info. Microsoft is running a registration campaign from July 6, 2026 to prompt affected users. Admins should audit SSPR registration coverage in the Entra admin centre now and run a targeted registration campaign for any user who relies solely on directory attributes. Also available: password writeback (requires Entra ID P1 + Microsoft Entra Connect or Cloud Sync) pushes the new password from the cloud back to on-premises Active Directory in real time, so hybrid users do not end up with a split password state. Figure 2 — SSPR flow — from forgot-password to signed in The user must pass the configured number of method gates before Entra writes the new password and (optionally) syncs it on-premises via writeback. SSPR flow — from forgot-password to signed in Forgot password Clicks reset link Identity check 1 or 2 method gates New password Banned-list checked Writeback Synced to on-prem AD Signed in Audit log written The user must pass the configured number of method gates before Entra writes the new password and (optionally) syncs it on-premises via writeback. 🔑 Authentication-methods policy tap to flip The single control plane in Entra ID that enables or disables each credential type (passkey, Authenticator, TOTP, SMS, TAP, CBA) with per-group targeting for all three use-cases: MFA, SSPR and passwordless. 🔒 SSPR tap to flip Self-Service Password Reset — users verify identity with 1 or 2 registered authentication methods and set a new password without calling the help desk. From September 2026, only explicitly registered methods are accepted. 🚫 Password protection tap to flip Global banned-password list (Microsoft-managed) + custom banned list (up to 1,000 org terms) checked at every password change or reset, with optional on-premises agents for AD DS domain controllers. ⏱️ Smart lockout tap to flip Cloud mechanism that temporarily blocks cloud authentication for an account after repeated failed attempts. Tracks familiar vs unfamiliar locations separately; does not lock the on-premises AD account. Set SSPR to require 2 methods, not 1 One method is easier to set up but risky — if that one method (e.g. a phone number) becomes inaccessible, the user is locked out. Two methods gives a fallback and is the Microsoft-recommended configuration for production. Enable both Authenticator app code and email OTP as minimum. Quick check · Q2 of 10 · Remember Starting September 7, 2026, which of the following will SSPR no longer accept for verification? a) A mobile phone number stored only in the user's directory profile attribute (never explicitly registered) b) Authenticator app codes registered in security-info c) Temporary Access Pass issued by an admin d) Hardware OATH TOTP token registered via combined registration Correct: a. From September 2026, SSPR requires explicitly registered methods. Directory-attribute phone numbers (mobilePhone, otherMail) that were never registered in security-info will be ignored entirely. 👉 So far: SSPR needs scope + number of gates + registered methods. From September 7, 2026, only explicitly registered methods count — directory-attribute phone numbers are ignored. ## ③ Password protection — banned passwords and smart lockout Microsoft Entra Password Protection enforces a global banned-password list maintained by Microsoft that is applied automatically to every tenant with no configuration needed. It catches common weak choices — not just dictionary words, but character-substitution variants such as P@ssw0rd . Organisations can layer a custom banned-password list (up to 1,000 terms) with company-specific words — brand names, product codes, city names common in credentials — applied at every password change or reset. Password Protection can also be extended on-premises via agents installed on domain controllers, bringing the same banned-list logic to AD DS password changes. Smart lockout operates silently in the cloud. After a configurable number of consecutive failed password attempts (default threshold: 10 in the cloud), Entra ID temporarily blocks that account from cloud authentication for an increasing lockout duration. Smart lockout tracks familiar vs unfamiliar locations separately, so a legitimate user on their usual device is less likely to be blocked by an attacker trying from a new IP. Admins can adjust the lockout threshold and duration in Entra admin centre ▸ Protection ▸ Authentication methods ▸ Password protection . Importantly, smart lockout does not lock the on-premises AD account — hybrid environments need separate AD fine-grained password policies for that. Figure 3 — Password protection layers Three layers work together at every password change or reset — global list, custom list, and on-premises agents for AD DS. Password protection layers Global banned list Microsoft-managed, auto-applied to all tenants Custom banned list Up to 1,000 org-specific terms On-prem agents Same logic pushed to AD DS DCs Three layers work together at every password change or reset — global list, custom list, and on-premises agents for AD DS. 'Smart lockout protects on-prem AD too' — it does not Smart lockout only throttles cloud authentication in Entra ID. If an attacker is hitting your on-premises AD directly (e.g. via Kerberos or LDAP on the LAN), smart lockout is blind to those attempts. Configure AD fine-grained password policies and account lockout policies on your domain controllers separately. ### ▶ Watch a user reset their password through SSPR end-to-end Step through the healthy SSPR path, then Break it to see what happens when a user has no registered method. ① Forgot password User clicks 'Can't access your account?' on the sign-in page and enters their user principal name. ▼ ② Method gate Entra ID presents the user's registered authentication methods. The user chooses Authenticator app code and enters the 6-digit TOTP. ▼ ③ New password User enters a new password. Entra checks it against the global and custom banned-password lists before accepting. ▼ ④ Writeback + done Password writeback syncs the new credential to on-premises AD in real time. Audit log entry is created. User signs in. Press Play to step through the healthy SSPR flow. Then press Break it . ▶ Play Next ▶ ⚠ Break it ↺ Reset Quick check · Q3 of 10 · Apply A user at your Bengaluru office keeps picking 'Techclick@2024' as their password. What prevents this? a) Smart lockout after 10 failed login attempts b) Adding 'Techclick' to the custom banned-password list in Entra Password Protection c) A Conditional Access policy requiring MFA d) Certificate-Based Authentication Correct: b. The custom banned-password list lets you add organisation-specific terms (brand names, product codes, city names). Entra Password Protection then blocks any variant of those terms at every password change or reset. 👉 So far: Password protection = global banned list (auto) + custom list (up to 1,000 terms) + optional on-prem agents. Smart lockout throttles cloud auth only — AD lockout is a separate config. ## ④ Combined registration — one flow for security-info and MFA Combined registration (also called the combined security-info registration experience) is the unified portal at aka.ms/mysecurityinfo where users register all their authentication methods — MFA second factors, SSPR reset methods and passwordless credentials — in a single flow. Before combined registration existed, users faced two separate enrolment prompts (one for MFA, one for SSPR), which caused confusion and duplicate registrations. Combined registration is enabled by default for all new and most existing tenants; legacy per-feature registration pages are being retired. The registration campaign feature in the authentication-methods policy lets admins schedule a prompt — a non-dismissible interrupt after successful sign-in — that nudges users who have not yet registered their security info. You can target campaigns to specific groups and set a snooze period (up to 14 days). This is the primary mechanism Microsoft recommends for the July 2026 SSPR campaign. Temporary Access Pass (TAP) integrates tightly here: issue a TAP to a new or locked-out user, they sign in, and combined registration immediately walks them through adding a permanent second factor — no old password required. Figure 4 — Legacy per-feature vs combined registration Combined registration replaces two separate enrolment prompts with one unified security-info flow, reducing user confusion and duplicate help-desk calls. Legacy per-feature vs combined registration Legacy (two prompts) Separate MFA setup screen Separate SSPR enrolment page Users prompted twice, skip SSPR Two audit event streams Combined registration One aka.ms/mysecurityinfo portal MFA + SSPR + passwordless in one Registration campaign nudges Single audit stream, TAP Combined registration replaces two separate enrolment prompts with one unified security-info flow, reducing user confusion and duplicate help-desk calls. Priya, an IAM engineer at a Pune-based IT services firm, faces this After enabling SSPR for all 4,000 users, the help desk still receives dozens of 'I can't reset my password' calls. Investigation reveals many users only have a phone number in their Active Directory attribute — it was synced from HR but never registered as an authentication method. Likely cause SSPR was relying on directory-attribute phone numbers (mobilePhone) rather than explicitly registered methods. Starting September 2026 this will be blocked entirely; even before that, users without a registered method see no valid gate. Diagnosis Entra admin centre ▸ Protection ▸ Password reset ▸ Registration — filter for users with 0 registered methods. Cross-check against SSPR-enabled scope. Entra admin centre ▸ Protection ▸ Authentication methods ▸ Registration campaign Fix Enable a registration campaign targeting the SSPR-scoped group, set a 7-day snooze. Issue TAPs to accounts completely locked out. Before September 7, 2026, verify all users in scope have at least 1 explicitly registered method. Verify Re-run the registration coverage report: all SSPR-enabled users show 1+ registered methods. Help-desk SSPR tickets drop to near zero within two weeks. Audit registration coverage before July 2026 Go to Entra admin centre ▸ Protection ▸ Password reset ▸ Registration and check the 'Users registered for self-service password reset' report. Any user showing 0 registered methods who is in your SSPR scope will fail to reset from September 2026. Run the registration campaign now, not in August. Quick check · Q4 of 10 · Analyze A new employee has no password yet. Which Entra feature lets them sign in and immediately register a permanent second factor without needing an existing credential? a) Security questions configured in SSPR b) Smart lockout bypass by the admin c) Guest B2B invitation link d) Temporary Access Pass (TAP) used with combined registration Correct: d. Temporary Access Pass (TAP) is a time-limited passcode issued by an admin. The user signs in with the TAP and combined registration immediately walks them through enrolling a permanent second factor — no old password required. 👉 So far: Combined registration at aka.ms/mysecurityinfo unifies MFA + SSPR + passwordless enrolment in one flow. Use TAP for new users; use registration campaigns to nudge unregistered users before the 2026 enforcement deadline. ### 🤖 Ask the AI Tutor Tap any question — instant, scoped to this lesson. No login, no waiting. What is the authentication-methods policy in Microsoft Entra ID? How do you configure SSPR and what are the key settings? What is the September 2026 SSPR change? How does Entra Password Protection work? What does smart lockout do and what does it NOT protect? What is combined registration and when should you use TAP with it? Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in. ## 📝 Wrap-up assessment — six more You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end. Q5 · Remember Which Entra admin centre blade is the single place to enable or disable individual authentication methods such as passkeys or SMS? a) Entra admin centre ▸ Users ▸ Per-user MFA b) Entra admin centre ▸ Protection ▸ Authentication methods c) Entra admin centre ▸ Conditional Access ▸ Named locations d) Entra admin centre ▸ Identity governance ▸ Access reviews Correct: b. The authentication-methods policy at Protection ▸ Authentication methods is the single control plane. Per-user MFA is a legacy method; Conditional Access is for enforcing methods, not enabling them. Q6 · Understand A user needs to reset their password via SSPR but only has a phone number stored in their AD attribute — never registered as an authentication method. What happens from September 7, 2026 onwards? a) SSPR uses the directory attribute as normal b) SSPR ignores the directory attribute and the user sees no valid reset method c) Smart lockout prevents the reset attempt d) Conditional Access steps up to require MFA Correct: b. From September 2026, SSPR only accepts explicitly registered methods. Directory-attribute phone numbers (mobilePhone, otherMail) that were never enrolled in security-info are ignored entirely. Q7 · Apply You want to allow only the security team to use hardware OATH tokens while all other staff use Microsoft Authenticator. How do you configure this in Entra? a) Create two separate Entra tenants b) Write a PowerShell script to enable OATH tokens per user c) Enable OATH tokens for the security-team group and Authenticator for all users in the authentication-methods policy using per-group targeting d) Configure this in Active Directory group policy Correct: c. The authentication-methods policy supports include/exclude group targeting for each method, enabling staged rollouts and role-specific configurations within a single tenant. Q8 · Analyze An attacker is spraying passwords against your on-premises Active Directory via LDAP on the internal network. Does Entra smart lockout block this? a) Yes — smart lockout blocks all authentication attempts including on-prem b) Only if Entra Connect password hash sync is enabled c) No — smart lockout only throttles cloud authentication in Entra ID; on-prem AD needs its own lockout policy d) Yes — smart lockout integrates with AD fine-grained password policies automatically Correct: c. Smart lockout protects cloud authentication in Entra ID only. Attacks directly on on-premises AD (LDAP, Kerberos) bypass it. You need AD fine-grained password policies and account lockout settings on domain controllers. Q9 · Evaluate A new employee joins remotely and has no existing Entra credential. Which flow gets them registered for MFA without needing a temporary password sent by insecure email? a) Reset their password via SSPR and then register MFA b) Issue a Temporary Access Pass (TAP), let them sign in, and guide them through combined registration to add a permanent second factor c) Enable security defaults so they register on first login with no passcode needed d) Have them call the help desk to verbally verify identity then enable their account Correct: b. TAP is specifically designed for bootstrapping new or locked-out users. The admin issues a time-limited passcode, the user signs in, and combined registration walks them through enrolling a permanent credential — no insecure email link required. Q10 · Evaluate What is the strongest reason to add your company name and common internal product codes to the custom banned-password list? a) It reduces the length of the global banned list b) The global list does not check for dictionary words c) Custom terms enable smart lockout to fire faster d) Employees commonly pick branded passwords (e.g. CompanyName@2024) that pass generic complexity rules but are trivially guessable by targeted attackers Correct: d. Targeted attackers (especially insiders or those who researched the company) try brand and product names first. The global list catches generic weak passwords; the custom list fills the organisation-specific gap that generic rules miss. Submit all answers Try again Lesson complete — saved to your profile. Almost! You need 70% (7 of 10) — re-read the path that tripped you up and tap "Try again". ### 🧠 In your own words Type one line: what is the difference between what the authentication-methods policy controls and what Conditional Access controls? Then compare with the expert version. Compare with expert answer Expert version: The authentication-methods policy decides which credential types exist and which users can register them — it is the supply side. Conditional Access decides which credential strength is required for a given sign-in context (app, risk level, location) — it is the demand side. You need both: enable passwordless in the auth-methods policy first, then write a Conditional Access policy that requires authentication strength 'Passwordless MFA' for your sensitive apps. ### 🗣 Teach a friend Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary. Generate my one-liner 📩 Quiz me on this in 7 days. Opt in and we'll email 3 micro-questions on Microsoft Entra ID at Day 1, Day 7 and Day 30 — spaced repetition is how this sticks. Un-tick any time. ### 📖 Glossary Authentication-methods policy The Entra ID control plane that enables or disables each credential type (passkey, Authenticator, TOTP, SMS, TAP, CBA) with per-group targeting, feeding MFA, SSPR and passwordless simultaneously. SSPR (Self-Service Password Reset) Feature that lets users reset or unlock their account by verifying identity with 1 or 2 registered authentication methods — no help-desk call required. Password writeback Feature (requires Entra ID P1 + Entra Connect or Cloud Sync) that syncs a new SSPR-set password from Entra ID to on-premises Active Directory in real time. Smart lockout Entra ID cloud mechanism that silently throttles authentication attempts after repeated failures, tracking familiar vs unfamiliar locations; does not lock the on-prem AD account. Custom banned-password list An organisation-defined list of up to 1,000 terms (brand names, product codes, etc.) that Entra Password Protection blocks at every password change or reset. Combined registration Unified enrolment portal (aka.ms/mysecurityinfo) where users register MFA, SSPR and passwordless credentials in one flow, replacing legacy dual-prompt experience. Temporary Access Pass (TAP) A time-limited, admin-issued passcode in Entra ID that lets a user sign in without a password to bootstrap combined registration or recover a locked account. Registration campaign A scheduled interrupt in Entra ID that prompts users without security-info to register their authentication methods — primary tool for the July 2026 SSPR prep campaign. #### 📚 Sources Microsoft Learn — Authentication methods in Microsoft Entra ID . learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods - Microsoft Learn — How it works: Microsoft Entra self-service password reset . learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks - Microsoft Learn — Password protection in Microsoft Entra ID . learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad - Microsoft Tech Community — Microsoft Entra ID security updates: What organisations need to do now . techcommunity.microsoft.com/blog/microsoft-entra-blog/microsoft-entra-id-security-updates-what-organizations-need-to-do-now/4522024 - Microsoft Learn — Combined security information registration for Microsoft Entra ID . learn.microsoft.com/en-us/entra/identity/authentication/concept-registration-mfa-sspr-combined - Microsoft Learn — Temporary Access Pass in Microsoft Entra ID . learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass ### What's next? Got authentication methods down? Next, go deep on Conditional Access policies — how named locations, sign-in risk, device compliance and authentication-strength requirements let you enforce exactly the right factor at the right moment. Next · All interview lessons → Practice on exam.techclick.in → --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt