Require two methods to reset a password with SSPR

Description

In the self-service password reset settings, Number of methods required to reset is set to 2. Users prove their identity with two different registered methods (for example an Authenticator notification and an alternate email) before setting a new password.

Since the move to the unified authentication methods policy, the methods available for SSPR follow that policy; avoid relying on SMS and voice where they are disabled (CB-M365-AUTH-011). Administrators already need two methods under Microsoft's administrator policy.

Rationale

A password reset is an account takeover path: whoever completes it owns the account until the user notices. With one method, compromising a single phone number or personal mailbox is enough. Two independent methods raise the bar to the level expected of a sign-in with MFA.

Impact

Users must register at least two reset methods, otherwise they cannot use SSPR. Users who lose one method need the help desk more often.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Password reset > Authentication methods.
3. Check that Number of methods required to reset is 2.
4. Fail if it is 1.

Remediation

1. Check in Entra ID > Authentication methods > User registration details how many users have fewer than two methods; run a registration campaign first if needed.
2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
3. Browse to Entra ID > Password reset > Authentication methods.
4. Set Number of methods required to reset to 2 and Save.

Rollback

Set Number of methods required to reset back to 1.

References

• How self-service password reset works - authentication methods Microsoft, vendor-doc, accessed 2026-10-24
• Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-M365-AUTH-039 Enable self-service password reset for all users
• related CB-M365-AUTH-011 Disable SMS and voice call as authentication methods

People and lifecycle