Entra SSPR Registration and Lockout Problems: Troubleshooting Guide

When self-service password reset (SSPR) fails in Microsoft Entra ID, the cause is almost always one of four things: SSPR is not enabled for the tenant or the user's group, the user has no licence, the user has not registered enough authentication methods for the policy, or the user has been throttled for too many attempts. The error code or message on the SSPR page tells you which one, and each has a fix in the Microsoft Entra admin center or on the user's account.

Who this is for and what you will have at the end

This guide is for help desk staff and identity administrators who handle tickets such as "I can't reset my password", "it says contact your administrator" or "I never get the code". It focuses on registration and lockout problems. If you are still setting SSPR up for a hybrid tenant, start with Entra SSPR setup and password writeback.

At the end you will have:

• A decision path from error message to cause.
• A table of the SSPR error codes users see and what to change for each.
• Fixes for registration problems, including missing methods, phone formats and email delivery.
• An explanation of throttling and of the separate sign-in lockout behaviour.
• A short list of settings to review so tickets do not come back.

How SSPR decides whether a user can reset

Knowing the order of checks makes the errors easier to read. When a user enters their user ID at the SSPR portal (https://aka.ms/sspr) and passes the captcha, Microsoft Entra ID checks:

1. Whether SSPR is enabled for that user. If not, the user is told to contact an administrator.
2. Whether the user has enough authentication methods registered to meet the policy. The policy requires either one or two methods. If the user has fewer than required, they are told to contact an administrator.
3. Whether the user holds an administrator role. If so, the fixed two-gate policy applies.
4. Where the password is managed. If it is managed on-premises (federated, pass-through authentication or password hash synchronization) and password writeback is not configured, the user is told to contact an administrator.

Only when all checks pass is the user guided through the reset.

Step 1: Read the error the user sees

Microsoft documents specific errors and technical details. Ask the user for the exact text or the code that starts with SSPR_:

The generic message "Your administrator has not enabled you to use this feature" appears when the directory is not enabled for password reset or when the user has no Microsoft Entra ID licence assigned.

Step 2: Fix configuration and scope problems

SSPR is not enabled, or the user is out of scope

In the Microsoft Entra admin center, open the Password reset page under Protection and set Self-service password reset enabled to Selected or All, then Save.

If you chose Selected, remember:

• Only one Microsoft Entra group can currently be enabled for SSPR through the admin center.
• Nested groups are supported as part of a wider deployment.
• The users in that group must have the appropriate licences.

If Password reset is missing from the Protection menu altogether, the administrator signed in does not have a Microsoft Entra ID licence assigned. Assign one and reload.

The user is not licensed

An unlicensed user gets the same "not enabled" message as a user outside the group. Check licences on the user, or on the group if you use group-based licensing. Our guide to group-based licensing in Microsoft 365 covers how licences are assigned through groups.

Writeback for hybrid users

If the user's password is managed on-premises and writeback is not deployed, the user is told to contact an administrator. Enable password writeback, then read the writeback troubleshooting page for SSPR_0029 and SSPR_0030. If a reset succeeds on-premises but the cloud update fails, the user sees a message that the password was reset but they must wait a few minutes for the change to be committed to the cloud. Microsoft notes this can be caused by a time-out, a cloud password policy, throttling or other reasons.

Step 3: Fix registration problems

Users register at https://aka.ms/ssprsetup, or through the combined security information registration. When registration is not required at sign-in, users are not prompted and must register themselves. You can turn on Require users to register when signing in, which prompts users in Microsoft 365, the Microsoft Entra admin center, the Access Panel, federated applications and custom applications that use Microsoft Entra ID. Users can cancel the prompt, but they are asked again at every sign-in until they finish.

Too few methods registered

When the policy requires two methods and the user has one, the user cannot reset and is told to contact an administrator. The reverse also bites: if you raise the policy from one method to two, users who registered only one become unable to reset.

Changing which methods are available can also strand users. If you disable a method that some users registered, users who now have too little usable data cannot reset until they register a method that is still enabled.

Microsoft Authenticator counts once

For SSPR, Microsoft Authenticator, software OATH tokens and hardware OATH tokens count as a single method. A user cannot combine them to meet a two-method requirement. Microsoft also states that Authenticator cannot be the only method when one method is required, and that Authenticator plus only one other method cannot be selected when two are required. Enable at least one additional non-app method, for example email or phone.

Available SSPR methods are Microsoft Authenticator notifications, hardware OATH tokens (preview), software OATH tokens, SMS, voice call and email OTP. A user can only reset with a method you have enabled.

Authentication methods that show up when you disabled them

Combined registration considers three policies: SSPR, MFA and the Authentication methods policy. If you disable app notifications in SSPR but they are enabled in the MFA policy, the option still appears in combined registration. Similarly, Office phone is still offered if the user has the Phone/Office property set, even when it is disabled in SSPR. Align all three policies before you troubleshoot.

Phone call or SMS never arrives

• Check the format of the number in the directory. Microsoft's example is +1 4251234567.
• SSPR does not support extensions. Extensions are stripped before the call is made, so use a number without an extension or integrate the extension into the number in your PBX.
• When validating a number, the user must enter the complete number, including the area and country code, and it must match the one on file.

Email code never arrives

The most common cause is a spam filter. Ask the user to check spam, junk and deleted items, and confirm they are checking the mailbox registered for SSPR. SSPR emails come from [email protected] and [email protected] in the public cloud, so allow those senders if your filtering is strict.

If the user's UPN differs from the primary proxy address or SMTP address, the Sign-in to Microsoft Entra ID with email as an alternate login ID setting must be enabled for the tenant, or the user sees an error when using their email address.

Registration is restricted to trusted locations

If you created a Conditional Access policy that targets the Register security information user action, users outside trusted locations must complete MFA or use a Temporary Access Pass to register. The policy applies only when a user opens a combined registration page, and users must be enabled for combined registration. In the policy, the location condition includes Any location and excludes All trusted locations. If new hires cannot register from home, this is a likely cause.

Guests and personal accounts

Microsoft accounts granted guest access, such as Hotmail.com or Outlook.com addresses, cannot use Microsoft Entra SSPR. B2B users from a partner Microsoft Entra tenant follow the partner tenant's policy, so SSPR must be enabled there.

Step 4: Understand SSPR throttling

Microsoft Entra ID throttles SSPR to stop repeated attempts. A user is blocked when they:

• Attempt to validate a phone number five times in one hour.
• Attempt to use the security questions gate five times in one hour.
• Attempt to reset a password for the same user account five times in one hour.

A blocked user must wait 24 hours after the last attempt, then can reset their password. Tell users not to keep retrying, because the 24 hours are counted from the last attempt. If the user cannot wait, an administrator can reset the password.

If SSPR cannot reach the user after a temporary service error or bad contact data, the user waits 10 seconds and sees links for Try again and Contact your administrator. The second option sends a form email to administrators asking for a reset.

Sign-in smart lockout is a different control

Do not confuse SSPR throttling with account sign-in lockout. By default an account is locked out after 10 unsuccessful sign-in attempts with the wrong password, for one minute, and the duration grows with further incorrect attempts. Smart lockout tracks the last three bad password hashes so repeating the same wrong password does not increase the counter. You can define the smart lockout threshold and duration.

Step 5: Account for the administrator policy

Administrators are not enabled in the same way as users. By default, administrator accounts can use SSPR with a two-gate policy that Microsoft manages and you cannot change. It requires two pieces of authentication data such as an email address, authenticator app or phone number, and prohibits security questions. Office and mobile voice calls are also prohibited for trial or free versions of Microsoft Entra ID.

This policy applies to the listed administrator roles when any of these is true: 30 days have elapsed in a trial subscription, a custom domain is configured, or Microsoft Entra Connect synchronizes identities. A one-gate policy applies during the first 30 days of a trial, or when only the default onmicrosoft.com domain is used and Microsoft Entra Connect is not synchronizing.

You can switch off SSPR for administrators by setting allowedToUseSspr on the tenant authorization policy to false:

Connect-MgGraph -Scopes Policy.ReadWrite.Authorization
Update-MgPolicyAuthorizationPolicy -AllowedToUseSspr:$false

Changes can take up to 60 minutes. If you disable administrator SSPR, exclude administrators from the user policy as well. Otherwise they are still prompted to register but see a message that they cannot register any methods.

Always test SSPR as a user who has no administrator roles.

Step 6: Password policy errors after a successful verification

Sometimes verification works and the reset still fails because of the new password:

The Microsoft Entra cloud policy requires 8 to 256 characters and three of four character types (lowercase, uppercase, numbers and symbols). Unicode characters are not allowed. In hybrid setups, a password with a Unicode character may be accepted on-premises but not in Microsoft Entra ID.

Verification checklist

After a fix, test as the affected user's profile rather than as an administrator:

1. Browse to https://aka.ms/sspr and enter the user ID.
2. Confirm that the verification step offers the methods you expect.
3. Complete a reset and confirm the user can sign in with the new password.
4. For hybrid users, confirm the new password works on-premises as well.
5. Check the Self-Service Password Management audit event category. If it is empty, the administrator viewing it may not have a Microsoft Entra ID licence.

Prevention checklist

• Enable SSPR for a group that matches the licensed population, and keep the licence assignment aligned.
• Require at least two registered methods, and make sure at least one method is not Microsoft Authenticator or an OATH token.
• Turn on Require users to register when signing in so users register before they are locked out.
• Align the SSPR, MFA and Authentication methods policies so users are not offered methods that cannot be used.
• Set a reconfirmation interval, from 0 to 730 days, if you want users to periodically check their details. A value of 0 means they are never asked.
• Enable notifications so users are told when their password is reset.
• When you change the required number of methods or the allowed methods, warn users first.

References

• Troubleshoot self-service password reset (Microsoft Learn)
• Self-service password reset deep dive (Microsoft Learn)
• Self-service password reset policies (Microsoft Learn)
• Combined security information registration (Microsoft Learn)