Microsoft Password Reset Portal Could Reveal Users and MFA Protection Details
Microsoft Entra ID’s public password-reset portal can reveal valid accounts and registered MFA methods to unauthenticated users.
LevelBlue researcher Matthew Coady found that Microsoft Entra ID’s public Self-Service Password Reset portal returns different responses for valid and invalid usernames. Unauthenticated queries can reveal whether an account exists, whether it is eligible for SSPR, and which verification methods are registered, including Microsoft Authenticator, SMS, voice calls, or security questions. Differing policy errors may also help distinguish privileged accounts when SSPR is limited to selected groups. A public proof-of-concept named ResetSpy automates the enumeration; Microsoft throttles resets, but organizations should still restrict SSPR and monitor repeated attempts.