{
  "id": "CB-M365-AUTH-041",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-041",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-041.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-041.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-041",
    "title": "Require SSPR registration at sign-in and reconfirmation every {{ sspr_reconfirm_days }} days",
    "finding": {
      "title": "Users are not required to register or reconfirm their password reset methods",
      "description": "Unregistered accounts cannot use SSPR, and stale methods (an old phone number, a former personal address) can be reused by someone else."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "sspr",
      "registration",
      "account-recovery"
    ],
    "description": "In the self-service password reset settings, **Require users to register when signing in** is\n**Yes** and **Number of days before users are asked to reconfirm their authentication\ninformation** is set to {{ sspr_reconfirm_days }} (never 0, which disables reconfirmation).\nUsers without reset methods register at their next sign-in, and every user checks periodically\nthat the registered methods are still theirs.\n",
    "rationale": "A reset method that belongs to someone else (a recycled phone number, an address of a former\npartner) is a ready-made takeover path. Periodic reconfirmation makes users remove methods they no\nlonger control. Forced registration also closes the window where an attacker with the password\nregisters their own methods first.\n",
    "impact": "Users see a registration or reconfirmation prompt at sign-in; they can skip it a limited number of\ntimes. The prompt only appears when SSPR is enabled for the user (CB-M365-AUTH-039).\n",
    "notes": "Registration should be protected by Conditional Access (CB-M365-AUTH-019) so that an attacker\nwith only the password cannot register methods. Combined registration means that methods\nregistered for MFA are also used for SSPR.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Password reset > Registration",
      "default_value": "Require users to register when signing in = Yes, reconfirmation = 180 days",
      "recommended_value": "Require users to register when signing in = Yes, reconfirmation = {{ sspr_reconfirm_days }} days"
    },
    "parameters": [
      {
        "name": "sspr_reconfirm_days",
        "type": "integer",
        "description": "Number of days after which users are asked to reconfirm their reset methods. 0 is not allowed (it disables reconfirmation).",
        "unit": "days",
        "default": 180,
        "minimum": 1,
        "maximum": 730
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Password reset** > **Registration**.\n3. Check that **Require users to register when signing in** is **Yes** and that **Number of days\n   before users are asked to reconfirm their authentication information** is between 1 and\n   {{ sspr_reconfirm_days }}.\n4. Fail if registration is not required or the number of days is 0 or above\n   {{ sspr_reconfirm_days }}.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n2. Browse to **Entra ID** > **Password reset** > **Registration**.\n3. Set **Require users to register when signing in** to **Yes**.\n4. Set **Number of days before users are asked to reconfirm their authentication information**\n   to {{ sspr_reconfirm_days }} and **Save**.\n",
      "rollback": "Set the values back to the previous ones.\n"
    },
    "references": [
      {
        "title": "How self-service password reset works - registration and reconfirmation",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-sspr-howitworks",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset",
        "url": "https://learn.microsoft.com/entra/identity/authentication/tutorial-enable-sspr",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-039",
        "type": "requires"
      },
      {
        "id": "CB-M365-AUTH-019",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}