Microsoft Authenticator and SSPR

Microsoft Authenticator is a mobile application that provides an additional layer of security for Azure AD sign-ins. It is a form of multi-factor authentication (MFA) that requires something you know (password) plus something you have (the app on your phone). The app supports two primary methods: time-based one-time passwords (TOTP) and push notifications. TOTP generates a six-digit code that changes every 30 seconds based on a shared secret and the current time (RFC 6238). Push notifications send a prompt to the user's phone asking them to approve or deny the sign-in attempt, including details like location and device.

When a user registers Microsoft Authenticator, Azure AD generates a shared secret (a key) that is stored in the app and in Azure AD. For TOTP, this secret is combined with the current time (in 30-second intervals) using a cryptographic hash to produce a six-digit code. The server performs the same calculation; if the codes match, the user is authenticated. For push notifications, Azure AD sends a notification to the app via the Microsoft Notification Service (MNS) or Apple Push Notification Service (APNs) for iOS. The app displays sign-in details, and the user's approval sends a signed response back to Azure AD, verifying the user's identity. The app also supports phone sign-in (passwordless) where the user enters a number on the sign-in screen and then approves the notification, eliminating the need for a password.

SSPR allows users to reset their own passwords without contacting a help desk. It reduces IT support costs and improves user productivity. SSPR requires Azure AD Premium P1 or P2 licensing. The feature must be enabled and configured by an administrator. Users must register their authentication methods before they can use SSPR.

When a user attempts to reset their password, they go to the SSPR portal (https://passwordreset.microsoftonline.com). They enter their username and complete a CAPTCHA. Then they must verify their identity by providing information from pre-registered authentication methods. Common methods include: - Email: A one-time code sent to an alternate email address. - Mobile Phone: A phone call or SMS with a verification code. - Office Phone: A phone call with a verification code. - Security Questions: Pre-defined questions (e.g., "What is your favorite color?"). - Mobile App Notification: A push notification via Microsoft Authenticator. - Mobile App Code: A TOTP code from Microsoft Authenticator.

The user must complete the number of verification steps required by the administrator (typically 1 or 2). Once verified, the user can set a new password that meets the tenant's password policy. The new password is then synchronized to on-premises Active Directory if password hash synchronization or pass-through authentication is configured.

To configure SSPR via PowerShell:

# Connect to Azure AD
Connect-AzureAD

# Enable SSPR for all users
Set-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | Where-Object {$_.DisplayName -eq "Password Reset"}).Id -Values @{EnablePasswordReset="True"}

# Set number of methods required
Set-AzureADDirectorySetting -Id (Get-AzureADDirectorySetting | Where-Object {$_.DisplayName -eq "Password Reset"}).Id -Values @{NumberOfQuestionsRequiredToReset="2"}

To check SSPR status:

Get-AzureADDirectorySetting | Where-Object {$_.DisplayName -eq "Password Reset"}

To enable Authenticator for MFA via Graph:

# Requires Microsoft.Graph module
Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"
New-MgPolicyAuthenticationMethodPolicy -Id MicrosoftAuthenticator -State enabled

In a large enterprise with 50,000 employees, deploying Microsoft Authenticator for MFA reduces phishing risks significantly. The company configures Conditional Access to require Authenticator for all cloud app access. Users are guided through a registration campaign via email. The IT help desk sees a 90% reduction in account compromise tickets. However, some users lose their phones. The company enables SSPR with two methods: mobile app notification and alternate email. Users can reset their password from home without calling the help desk. The help desk now handles only 5% of previous password reset calls.

Another scenario: A hybrid organization with on-premises Active Directory uses password writeback. They enable SSPR for all users. When a user resets their password via SSPR, it syncs back to on-prem AD within 30 seconds. This allows the user to access on-premises resources like file shares with the same password. The IT team monitors SSPR usage via Azure AD logs, looking for unusual reset patterns that might indicate compromise.

A common misconfiguration: An admin sets the number of methods required to 1, thinking it's simpler. This weakens security because if a user loses access to that single method (e.g., phone), they cannot reset. Best practice is to require 2 methods. Another issue: users fail to register their methods. The admin must enforce registration via the "Registration campaign" or by making SSPR mandatory. Without registration, users are locked out and must call the help desk, defeating the purpose of SSPR.

Performance considerations: For Authenticator push notifications, the latency depends on the notification service (MNS/APNs). Typically under 2 seconds. For TOTP, no network latency is involved after the initial sync. SSPR is processed entirely in Azure AD; the only delay is the email or SMS delivery, which can take up to 5 minutes in rare cases. The system scales automatically to millions of users.