Microsoft Password Reset Portal Can Leak Account Verification Details

Microsoft’s Self-Service Password Reset (SSPR) portal can be used by unauthenticated actors to distinguish valid user accounts and, for some accounts, reveal registered password-reset verification methods (SMS, alternate email, authenticator apps). LevelBlue SpiderLabs showed this can also expose likely administrator accounts under specific tenant settings and released ResetSpy to automate enumeration; they recommend monitoring Entra Audit Logs, restricting SSPR access, removing weak verification methods, and requiring phishing-resistant authentication for privileged users.