Require SSPR registration at sign-in and reconfirmation every {{ sspr_reconfirm_days }} days

Description

In the self-service password reset settings, Require users to register when signing in is Yes and Number of days before users are asked to reconfirm their authentication information is set to {{ sspr_reconfirm_days }} (never 0, which disables reconfirmation). Users without reset methods register at their next sign-in, and every user checks periodically that the registered methods are still theirs.

Registration should be protected by Conditional Access (CB-M365-AUTH-019) so that an attacker with only the password cannot register methods. Combined registration means that methods registered for MFA are also used for SSPR.

Rationale

A reset method that belongs to someone else (a recycled phone number, an address of a former partner) is a ready-made takeover path. Periodic reconfirmation makes users remove methods they no longer control. Forced registration also closes the window where an attacker with the password registers their own methods first.

Impact

Users see a registration or reconfirmation prompt at sign-in; they can skip it a limited number of times. The prompt only appears when SSPR is enabled for the user (CB-M365-AUTH-039).

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Password reset > Registration.
3. Check that Require users to register when signing in is Yes and that Number of days before users are asked to reconfirm their authentication information is between 1 and {{ sspr_reconfirm_days }}.
4. Fail if registration is not required or the number of days is 0 or above {{ sspr_reconfirm_days }}.

Remediation

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Entra ID > Password reset > Registration.
3. Set Require users to register when signing in to Yes.
4. Set Number of days before users are asked to reconfirm their authentication information to {{ sspr_reconfirm_days }} and Save.

Rollback

Set the values back to the previous ones.

References

• How self-service password reset works - registration and reconfirmation Microsoft, vendor-doc, accessed 2026-10-24
• Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• requires CB-M365-AUTH-039 Enable self-service password reset for all users
• related CB-M365-AUTH-019 Protect security information registration with a managed device or MFA

People and lifecycle