Microsoft Password Reset Portal Could Reveal Users and MFA Protection Details
Microsoft Entra ID’s public password-reset portal can reveal valid accounts and registered MFA methods to unauthenticated users.
LevelBlue researcher Matthew Coady found that Microsoft Entra ID’s public Self-Service Password Reset portal returns different responses for valid and invalid usernames. Unauthenticated queries can reveal whether an account exists, whether it is eligible for SSPR, and which verification methods are registered, including Microsoft Authenticator, SMS, voice calls, or security questions. Differing policy errors may also help distinguish privileged accounts when SSPR is limited to selected groups. A public proof-of-concept named ResetSpy automates the enumeration; Microsoft throttles resets, but organizations should still restrict SSPR and monitor repeated attempts.
- Portal responses differ for valid, ineligible, and nonexistent Entra ID accounts.
- Eligible accounts can expose methods such as authenticator, SMS, voice, or security questions.
- Some tenant settings may make privileged accounts easier to identify.
- Public ResetSpy proof-of-concept automates enumeration despite Microsoft throttling.
- Limit SSPR scope, prefer phishing-resistant MFA, and monitor repeated reset attempts.
From the original article
3 min read at cybersecuritynews.com
Microsoft’s SSPR portal may expose sensitive account details to unauthenticated users, including whether an Entra ID account exists and its registered password-reset methods. Such exposure might assist attackers in refining their phishing, password-spraying, and social engineering attacks on corporate networks.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.