Entra password reset won't take directory phone numbers from February 2027. Who gets stuck?

A staff member forgets their password, types in the phone number HR has on file, and gets a code. That route is closing. Microsoft's documentation now says that from February 2027, Entra password reset only accepts methods a person has actually registered, so find those people and get them registered first.

Microsoft says about 86% of verifications already use registered methods. It doesn't break that down, and it counts verifications, so it won't tell you much about your tenant. A company that loaded mobile numbers from AD years ago and never ran a registration push could sit far from that average.

The failure is quiet too. Nobody gets locked out when the rule starts. A user finds out when they've forgotten a password, the reset page won't take the old number, and they're told to contact an administrator. If that's a Sunday night or a shared service desk, your team takes the call and has to decide how to prove who's on the line.

Microsoft files this under its Secure Future Initiative, and the reasoning holds up. Somebody typed that directory number in, maybe years ago, and it may now reach someone who doesn't work for you. Registering ties the method to the person using it. We'd do this work even if the date slipped again.

Directory values and authentication methods are two separate sets of data, and Microsoft's admin docs treat them that way. Public profile contact details live on the user object and, for synced users, are managed in on-premises AD. Authentication methods stay private and are only used for authentication. With default Entra Connect mappings, AD's telephoneNumber becomes Office phone and mobile becomes Mobile phone. Those are the values losing their standing here.

These changes hit the same people in the same quarter, and that's what should shape your plan. Tell everybody to register a mobile in February and it may not even work: once the SMS retirement reaches your tenant, users can't add SMS or voice methods, and numbers already registered stop working for SSPRdefinitionSelf-service password reset. Someone who's locked out proves who they are and sets a new password, and nobody in IT gets a call. after 50 days, unless you've set up a telephony providerdefinitionA phone company you hook up to Entra yourself. SMS and voice codes keep working through them after Microsoft's own service goes.. Do the registration push once, before then, and aim it at methods that will still be there in April.

Registering everyone is the visible task, but the choice underneath it is which recovery route each group of users gets. Office staff with company phones are easy. Warehouse shifts, students, contractors and people on leave usually aren't, and they're the ones who need a plan written down.

That third row catches people out. Passkeys don't meet SSPR's requirements, so a fully passwordless user can still fail a reset. Microsoft's answer is a setting called Allow password change after secure sign-in. A user who signs in with a passkey, a certificate or an Authenticator passwordless notification can set a new password in Security infodefinitionThe page in My Sign-Ins where people set up their own phone, email, app or token. Whatever they add there counts as registered. without typing the old one. Microsoft says it won't turn that on for you, and you can't scope it to a group.

Schools have the hardest version of this. An IT admin at a grades 6-12 school told Microsoft's Q&A forum that students use security questions, because not all of them have cellphones and those who do can't have them during the school day. A Microsoft moderator said there's no like-for-like replacement or education exception and suggested a Temporary Access PassdefinitionA short-lived code an admin hands out, for one sign-in or several. Someone with no methods uses it to get in and set one up.. The admin replied that it doesn't help on evenings, weekends or holidays when staff aren't around, and added that Microsoft support called this a known gap with a fix being worked on. We can't confirm that. Plan for those hours, or accept that a forgotten password waits for Monday.

# example: who can reset but hasn't registered
$scopes = "AuditLog.Read.All","User.Read.All"
$scopes += "UserAuthenticationMethod.Read.All"
Connect-MgGraph -Scopes $scopes
Get-MgReportAuthenticationMethodUserRegistrationDetail -All |
  Where-Object { $_.IsSsprEnabled -and -not $_.IsSsprRegistered } |
  Select UserPrincipalName, MethodsRegistered
# then compare directory values and phones
$upn = "[email protected]"
$f = "mobilePhone","businessPhones","otherMails"
Get-MgUser -UserId $upn -Property $f | Select $f
Get-MgUserAuthenticationPhoneMethod -UserId $upn
# example output (illustration, layout varies)
UserPrincipalName        MethodsRegistered
[email protected]         {}

Read that report carefully. Microsoft's notice sends you to User registration details, but it doesn't say how the report treats a directory value nobody registered. So cross-check a sample against the user's real registered methods before you trust the count. The report can lag by up to 36 hours and it leaves out disabled and soft-deleted accounts. A leaver who comes back, or a suspended contractor, won't be on your list. The report call needs AuditLog.Read.All and a reporting role, and Microsoft points to the same Entra ID P1 or P2 licensing as the Usage and insights screens. The phone lookup needs Global Reader or an authentication admin role, and Authentication Administrators only see masked numbers.

We read your tenant's policies and registration data, sort users into groups by the recovery route that will work for them, and test the result on real accounts before anyone gets a prompt. We also write the helpdesk check and the Temporary Access Pass process, and we plan this alongside the SMS retirement so your people register once. See our Microsoft Entra work, the engineers we place on Entra projects, or start with a free assessment. If your sync servers are part of the same plan, read our Entra Connect Sync and SMS MFA guide.