Entra SSPR stops accepting directory-sourced contact info on 5 October 2026 find the users now

On 5 October 2026, self-service password reset stops accepting contact information it never saw a user register. If your tenant bootstrapped SSPR by syncing phone numbers and emails out of Active Directory, some of your users are about to lose the ability to reset their own password, and nothing on their end will have changed.

The specific change is narrow and easy to miss. From that date, SSPR only accepts explicitly registered authentication methods. Directory-sourced properties, the mobilePhone, businessPhone and otherMails fields that were synced but never registered, no longer count for verification. A registration campaign follows on 9 November for tenants that require registration at sign-in, but that lands after the change, so treat it as a safety net, not a plan.

The exposed tenants are the ones that did the sensible-looking thing years ago. You turned on SSPR, and instead of chasing every user to register, you let Microsoft Entra Connect sync the contact data you already had. telephoneNumber mapped to Office phone, mobile mapped to Mobile phone, and users could reset a password without ever touching the registration page. That shortcut is what expires.

Find the users before the date does

You do not have to guess who is affected. Pull the users who carry directory-sourced contact data with Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "User.Read.All"

Get-MgUser -All -Property DisplayName,UserPrincipalName,MobilePhone,BusinessPhones,OtherMails |
    Where-Object { $_.MobilePhone -or $_.OtherMails } |
    Select-Object DisplayName, UserPrincipalName, MobilePhone, OtherMails

That gives you the population relying on synced data. The half that matters is the overlap with users who have no registered method at all. In the Microsoft Entra admin center, that list lives under Protection > Authentication methods > Registration, which reports who has registered what. The users who appear in the PowerShell output and have nothing in the registration report are the ones who lose SSPR on 5 October.

The fix is not exotic. Get those users to register at least one real method: Microsoft Authenticator, SMS, voice call, a FIDO2 key or a passkey. Turn on the registration campaign now, from Authentication methods > Registration campaign, and point it at the at-risk group rather than waiting for the automatic one in November.

Here is the honest read on this. Synced contact data was always a bootstrap, a way to skip the registration step, not a registered method. A reset path the user never confirmed is one you are guessing about. Microsoft is ending the guess. The only work is finding your users before the date finds them, and the query above is most of it.