Microsoft is tightening password reset security in Entra ID

Microsoft is tightening Entra ID self-service password reset security.

Starting September 7, users will need explicitly registered and validated authentication methods to reset passwords.

Directory contact data alone will no longer be enough for recovery.

A notification campaign begins in July, and organizations may need to update enrollment and recovery processes.

The change is part of Microsoft’s Secure Future Initiative to reduce account-takeover risk.