Enumerating Users and MFA via Microsoft's Password Reset Portal
September 23, 2026 · LevelBlue SpiderLabs · Severity: MEDIUM
This article reveals how Microsoft's Self-Service Password Reset portal can be abused to enumerate user accounts and their registered MFA methods, potentially identifying administrators. It explains the information leakage and provides defensive recommendations for organizations. 📌 **Analyst Note:** This enumeration technique highlights a common gap where legitimate features become reconnaissance tools. Organizations should treat SSPR as a sensitive endpoint and implement logging and anomaly detection.
Microsoft's Self-Service Password Reset (SSPR) portal is a legitimate feature designed to let users recover their accounts without calling the helpdesk. As it turns out, it also tells you quite a lot about the accounts in a tenant — whether they exist, what authentication methods they have registered, and in some cases, which ones are likely administrators. This post covers what the portal leaks, why it matters from both sides, and what defenders can do about it.
Key Takeaways
- Microsoft's Self-Service Password Reset portal inadvertently leaks whether an account exists, what authentication methods are registered, and sometimes which users are administrators.
- Attackers can use this information to target high-value accounts and bypass MFA by exploiting known methods registered in the portal.
- Defenders should restrict SSPR access, monitor for enumeration attempts, and enforce conditional access policies to mitigate this reconnaissance risk.