What Should Replace Security Questions for Self-Service Password Reset?

Replace security questions with a method that does not rest on a guessable answer: Microsoft Authenticator, an OATH token, a text message or voice call, or an email one-time passcode. Microsoft retires them for Microsoft Entra ID self-service password reset in March 2027. Users with nothing else registered need an identity check instead.

This post is for the team that owns self-service password reset (SSPR) in Microsoft Entra ID and has a few months before enforcement. Every Microsoft statement below comes from Microsoft Learn pages read on November 5, 2026.

When does Microsoft retire security questions for SSPR?

March 2027. Microsoft’s documentation carries a warning that reads: “Security questions will be retired for Self-Service Password Reset (SSPR) in March 2027. After that date, users will no longer be able to reset passwords using security questions.” (Microsoft Learn, Security questions authentication method, page dated February 18, 2026, read November 5, 2026). The page gives a month, not a day, and says “enforcement begins in March 2027.”

Microsoft gives its reason on the same page. The feature is being deprecated “due to security risks and low reliability,” and security questions are “often guessable or susceptible to social engineering, increasing the risk of account takeover during SSPR.”

The change reaches only the reset flow. The page says security questions “aren’t used as an authentication method during a sign-in event,” so nobody loses a way to sign in. Administrator accounts already cannot use security questions with SSPR.

Who is affected?

Anyone who registered security questions. The users at risk of being locked out are the ones who will be short of methods once the questions are gone.

SSPR requires one or two methods, whichever your policy sets. Microsoft’s deep dive states what happens next: “If a user doesn’t register the minimum number of required methods, they see an error page when they try to use SSPR. They need to request that an administrator reset their password.” (Microsoft Learn, Self-service password reset deep dive, page dated October 5, 2026, read November 5, 2026).

Microsoft’s own example of the problem is a policy that requires two methods and uses only an office phone and security questions. Take the questions out, allow a mobile phone and an alternate email instead, and “users without the mobile phone or alternate email fields populated now can’t reset their passwords.” Those users become calls to your help desk.

How do you find the users who rely on security questions?

Microsoft’s authentication methods activity report shows it. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator, then go to Entra ID, Authentication methods, Activity, and open the Registration tab (Microsoft Learn, Authentication Methods Activity, page dated October 22, 2025, read November 5, 2026).

1. Open “User registration details.” For each user it lists SSPR Registered, SSPR Enabled, SSPR Capable, and a “Methods registered” column that includes Security questions.
2. Filter or search the list on that column and look for users who will fall below your policy’s required number of methods once security questions are gone. In a one-method policy, that means security questions and nothing else SSPR accepts. In a two-method policy, it also means security questions plus one other method, counting Authenticator and OATH tokens together as one.
3. Under “Users registered by authentication method,” select a method to see who has registered for it.
4. Check “Registration and reset events” for the last 24 hours, 7 days or 30 days to see which users are still resetting with security questions today.

Three limits from Microsoft’s page. The report can lag by up to 36 hours. Disabled and soft-deleted users are not listed. Microsoft says a Microsoft Entra ID P1 or P2 license is required to access Usage and insights, which is what its instructions call this report.

What should replace security questions?

Microsoft lists these methods for SSPR. Each one has to be registered before the user needs it, so none of them helps a person with nothing registered.

Sources: Microsoft Learn, Self-service password reset deep dive (October 5, 2026) and Voice call authentication method (updated February 13, 2026), both read November 5, 2026.

Authenticator, software tokens and hardware tokens count as a single method, so a user with all three still has one. If your policy requires two, each user needs a second method from outside that group. Microsoft also says Authenticator “can’t be selected as the only authentication method when only one method is required.”

Microsoft says: “We highly recommend that you choose two or more authentication methods so that your users have more flexibility in case they’re unable to access one method when they need it.” You can also turn on “Require users to register when they sign in.” Users can dismiss that prompt, but they see it at every sign-in until they finish registering.

What happens to users with nothing else registered?

The registration prompt reaches people who sign in, and users can dismiss it. Retiring security questions does not fix the users who have nothing else registered. They hit Microsoft’s error page and call the help desk.

Attackers call help desks too. CISA’s advisory on Scattered Spider describes actors who “Posed as employees to convince IT and/or helpdesk staff to provide sensitive information, reset the employee’s password, and transfer the employee’s MFA to a device they control” (CISA Advisory AA23-320A). Mandiant found voice phishing was the initial infection vector in 11% of intrusions in 2025, second only to exploits (Mandiant, M-Trends 2026). A help desk that takes more reset calls after March needs a way to confirm who is calling that does not depend on what the caller knows.

ATO Protect Account Recovery+ for Entra ID is the Trusona product for that gap. The user scans a government-issued ID in a mobile browser. Trusona checks the ID against the authority that issued it and screens the phone number for SIM swaps. On a clean result, Trusona calls Microsoft Graph with your tenant’s own app registration to create a single-use Temporary Access Pass, and sends it to the verified number by SMS. The user signs in to Microsoft Entra ID with the pass and completes recovery. Trusona confirms the person before it creates a Temporary Access Pass, and only the identity check sits outside your authentication system. The pass is created inside your tenant.

The user installs no app and registers nothing in advance, so the flow covers users who never finished registering. It works at 2 a.m. on a Sunday, whether or not anyone is staffing the desk, and it is included free in the ATO Protect Suite.

It has limits. It relies on a government-issued ID, so a user without one is not covered. It does not ask for a selfie or run a liveness check. A number that moved to a new device recently is a reason to stop. And it does not replace SSPR: users who registered methods keep using Microsoft’s flow. The launch post covers how it works in more detail, and Rethinking self-service password resets covers why a check against an authoritative source differs from an enrolled factor. See the product page.

Frequently asked questions

When does Microsoft retire security questions for self-service password reset? In March 2027, according to Microsoft Learn. After that date users can no longer reset passwords with security questions. Microsoft’s page gives the month and not a day, so check it again before you plan around a specific date.

What replaces security questions in Entra SSPR? Microsoft lists Microsoft Authenticator push notifications, hardware and software OATH tokens, SMS, voice call and email one-time passcode as the methods available for SSPR. Each must be registered in advance. Microsoft recommends two or more.

Do security questions affect how users sign in? No. Microsoft says security questions are not used as an authentication method during a sign-in event. They apply only to self-service password reset.

What happens to a user whose only SSPR method is security questions? After March 2027 that user has no usable SSPR method. If a user has not registered the minimum number of methods your policy requires, Microsoft shows an error page and the user has to ask an administrator to reset the password.

How do I find users who registered security questions? Use the Registration tab of the authentication methods activity report in the Microsoft Entra admin center. Its user registration details list shows each user’s registered methods, including security questions. The report can lag by up to 36 hours.

Can administrators use security questions for SSPR? No. Microsoft says administrator accounts cannot use security questions as a verification method with SSPR.

How can a help desk handle users with no other method registered? Confirm the person before issuing any credential, using evidence the caller does not control, such as a government-issued ID checked with the authority that issued it. ATO Protect Account Recovery+ for Entra ID does this before it creates a Temporary Access Pass in your tenant.

Does Account Recovery+ replace Microsoft SSPR? No. Users who registered methods keep using Microsoft’s flow. Account Recovery+ is for the users that flow sends to an administrator.

The users left without another registered method are the ones your help desk will hear from. To talk through covering them before March, contact the Trusona team.