Microsoft SSPR Portal Can Reveal Accounts and Registered Authentication Methods
Summary
The article explains how Microsoft’s public SSPR portal can expose whether accounts exist and, for some users, their registered reset methods. It describes the risks, limitations, an automation tool, and defensive measures.
Key points
- Unauthenticated SSPR responses can distinguish valid accounts from nonexistent ones, including through responses indicating policy or eligibility issues.
- For accounts that reach method selection, the portal can reveal registered password-reset methods, which may help attackers tailor phishing or credential attacks.
- When SSPR is disabled for standard users, administrator accounts may still proceed to method enumeration, potentially making them distinguishable.
- SSPR and MFA methods often overlap but are not identical; FIDO2-only accounts, guest or federated users, and some policy states can limit or distort what the portal reveals.
- The article says Microsoft removed the portal’s visual CAPTCHA in August 2026, replacing it with backend throttling and behavior-based abuse detection.
- ResetSpy automates checking account responses and classifying visible SSPR methods and policy states.
- Recommended defenses include scoping SSPR, monitoring Entra audit logs for unusual activity, restricting weak reset methods, and requiring phishing-resistant MFA for administrators.
Article Details
- Topic
- User enumeration and authentication-method disclosure through Microsoft's Self-Service Password Reset portal, including the ResetSpy automation tool.