Did you know if you convert to the combined experience for SSPR and password reset, you can remove less secure phone, email, and text authentication? This is as long as you have Authenticator registered and higher methods allowed. See below for SSPR.
This works for SSPR and for password reset through My Sign-Ins.
The gotcha is if you have 2 methods required for SSPR, it will say your not registered for SSPR even if your enabled for it, but only have 1 method (Microsoft Authenticator) registered. As you can see below.
I would definitely recommend adding more secure options as well but at the minimum I’d use Authenticator or higher.
How do you keep your user protected in this situation?
Hope this quick tip was useful and have a great day!
Leave a Reply