Entra ID Security Updates 2026: Three Deadlines to Check Now

Microsoft spent the first half of 2026 closing enforcement gaps in Entra ID, and three of those changes carry hard dates. The Entra ID security updates 2026 wave, announced on the Microsoft Entra blog in June and revised in early August, changes how Conditional Access applies when users register security info and which methods self-service password reset (SSPR) will accept. One change is already live in your tenant. The next lands October 5, and the last cuts over November 9, 2026.

Here's the short version. Conditional Access policies that target security info registration now also fire during Windows Hello for Business provisioning and macOS Platform SSO registration. In October, Microsoft starts prompting your users to register SSPR methods, whether you asked for that or not. And in November, phone numbers and email addresses that exist only as directory attributes stop working for password reset.

If you deployed our free Conditional Access baseline, you already have policies in scope. This checklist walks through each change: what Microsoft modified, where to look in the Entra admin center, and what to fix before the help desk hears about it.

Key Takeaways

• Conditional Access policies targeting security info registration now also cover Windows Hello for Business and macOS Platform SSO.
• Microsoft deploys an automatic SSPR registration campaign in every tenant starting October 5, 2026.
• From November 9, 2026, SSPR accepts only explicitly registered authentication methods.
• Directory phone numbers and emails never formally registered will stop working for password reset.
• Bonus deadline: custom controls retire September 30, 2026, replaced by External MFA.

Entra ID Security Updates 2026: The Timeline at a Glance

All three changes come from a single announcement on the Microsoft Entra blog, published June 8, 2026 and updated August 4. Here's the calendar as it stands today:

• Week of July 13, 2026 (already live): Conditional Access policies targeting the Register security information user action now apply to Windows Hello for Business provisioning and macOS Platform Single Sign-On registration.
• September 30, 2026: Custom controls retire, replaced by External MFA, with end of life in May 2027.
• October 5, 2026: Microsoft begins an SSPR registration campaign that prompts affected users and administrators to register authentication methods. No admin action is needed to turn it on.
• November 9, 2026: SSPR accepts only explicitly registered authentication methods.

A note on dates. Microsoft's original Message Center post (MC1325414) announced SSPR enforcement for early September 2026, and many articles still show that timeline. The Entra blog now lists October 5 and November 9, so plan against those, but don't bet on another slip.

The custom controls retirement mostly affects organizations that wired Duo or another third-party MFA provider into Conditional Access years ago. If that's you, treat the External MFA migration as its own project. The rest of this guide focuses on the two changes that touch every tenant.

Deadline 1: Conditional Access at Security Info Registration (Live Now)

What changed

Until July, Conditional Access policies targeting the Register security information user action were enforced when users visited My Security Info or set up Microsoft Authenticator, but not during Windows Hello for Business provisioning or macOS Platform SSO registration. That was a real gap: a policy locking security info changes to trusted networks meant little if the same registration could happen through an enrolment flow the policy never saw.

The gap closed during the week of July 13, 2026, when Microsoft rolled the change out to all tenants (per the Microsoft Entra blog). The same policies now apply consistently across every registration experience. Users who don't meet the requirements get prompted to satisfy them before registration completes. MFA remains required by default for passwordless credential enrolment; Conditional Access sits on top as an extra control.

Check your tenant

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) with Security Reader or higher.
2. Go to Protection > Conditional Access > Policies.
3. Open each enabled policy and check Target resources. Any policy set to User actions > Register security information is in scope for this change.
4. Note what each in-scope policy demands: MFA, a compliant device, a trusted network or named location.
5. Go to Identity > Monitoring & health > Sign-in logs, open recent enrolment sign-ins, and check the Conditional Access tab to see which policies applied, or would have applied in report-only mode.

What to fix

Think through your onboarding path. A new hire unboxing an Autopilot laptop now hits your registration policy during Windows Hello setup. If that policy requires a compliant device, remember the machine may not report as compliant mid-provisioning. If it requires a trusted network, remote hires fail at step one.

The clean fix is a Temporary Access Pass for day-one onboarding. Enable it under Protection > Authentication methods > Policies > Temporary Access Pass, then issue one per new hire from Users > (select user) > Authentication methods. The pass satisfies MFA during registration and expires on its own. Our Conditional Access policy guide for SMBs covers policy design in more depth, including the break-glass exclusions you should already have in place.

Deadline 2: The SSPR Registration Campaign Starts October 5

What changed

Today, SSPR can verify a user with a mobile number, office phone, or alternate email that exists only as a directory attribute. Those are values an admin typed into the user object years ago, never confirmed by the user. Microsoft is ending that practice, and the transition starts with a nudge. Beginning October 5, 2026, a registration campaign interrupts affected users after sign-in and walks them through registering proper authentication methods. Administrators get prompted too. You don't enable anything; the campaign ships to every tenant automatically.

Check your tenant

1. Go to Protection > Authentication methods > User registration details in the Entra admin center.
2. Filter on SSPR Capable = Not capable. This is your exposure list: every account that couldn't complete a self-service reset with registered methods today.
3. Export the list and cross-reference it against active employees. Service accounts will show up; handle those separately.
4. Review your SSPR policy under Protection > Password reset: how many methods you require, which ones you allow, and which groups are enabled for SSPR at all.

What to fix

Get ahead of Microsoft's prompts with your own communication. A two-line message in Teams beats a surprise interrupt screen: tell staff the prompt is legitimate, when it starts, and what to do with it. If you also turn on the separate Authenticator registration campaign under Protection > Authentication methods > Registration campaign, you can move users into the Authenticator app first, which covers MFA and SSPR in a single registration. Based on field observations, warned users complete the prompt; surprised users call the help desk or report it as phishing.

Deadline 3: SSPR Accepts Only Registered Methods From November 9

What changed

Starting November 9, 2026, SSPR accepts only authentication methods that users or administrators explicitly registered (per the Microsoft Entra blog). Directory-sourced phone numbers and email addresses that were never formally registered stop counting. Microsoft frames this as aligning SSPR with the rest of the Entra authentication model: verification should prove possession and intent, not echo whatever sits in an attribute field.

Check your tenant

1. Re-run the User registration details report in late October and compare it with your baseline. The campaign should have shrunk your Not capable list.
2. Check Protection > Authentication methods > Activity for registration and reset events. Rising registrations mean the campaign is working; failed resets after November 9 mean someone slipped through.
3. Confirm your help desk knows the date. Failed self-service resets become password-reset tickets, which need identity verification steps of their own.

What to fix

For executives, field staff, and anyone who ignores prompts, register methods on their behalf: Users > (select user) > Authentication methods > Add authentication method, then add a phone number or email directly. Methods registered by an administrator count as registered. For everyone else, let the campaign do its work and watch the Not capable number drop week over week.

Your 30-Minute Entra Tenant Checklist

Run this sweep once now and again in late October:

1. List Conditional Access policies targeting Register security information (Protection > Conditional Access > Policies).
2. Test a full Windows Hello for Business enrolment on a fresh or reset device and confirm it completes.
3. Enable Temporary Access Pass if it isn't already on (Protection > Authentication methods > Policies).
4. Pull the User registration details report and export accounts that aren't SSPR capable.
5. Review your SSPR method policy and enabled groups (Protection > Password reset).
6. Pre-register methods for VIPs and prompt-ignorers from each user's Authentication methods blade.
7. Turn on the Authenticator registration campaign (Protection > Authentication methods > Registration campaign).
8. Tell staff about the October 5 prompts and the November 9 cutoff in plain language.
9. If custom controls appear anywhere in Conditional Access, start the External MFA migration before September 30.
10. Recheck sign-in logs and the Activity report after each change.

None of this needs new licensing, just admin time. If nobody on your team owns identity administration, that's the gap a managed IT partner fills: someone tracks Microsoft's enforcement calendar so changes land before the deadline, not after the outage. Our cybersecurity service bakes registration policies into every baseline we deploy.

FAQ

Do Conditional Access policies now apply to Windows Hello for Business setup?

Yes. Since the week of July 13, 2026, policies targeting the Register security information user action also apply during Windows Hello for Business provisioning and macOS Platform SSO registration. Users who don't meet the policy are prompted to satisfy it before registration completes. Test your onboarding flow end to end to confirm new devices still enrol cleanly.

Why do some articles say SSPR enforcement starts in September 2026?

That was Microsoft's original window: Message Center post MC1325414 first announced enforcement for early September 2026. Microsoft later revised the timeline. The Entra blog, updated August 4, 2026, now lists October 5 for the registration campaign and November 9 for enforcement. Work from the revised dates, but don't assume they'll move again.

What happens to users with no registered SSPR methods after November 9, 2026?

Their self-service password resets fail. Phone numbers and email addresses that exist only as directory attributes will no longer verify identity, so those users must call your help desk for a manual reset. Registering at least one proper method before the deadline avoids the disruption entirely.

Do I need to enable the SSPR registration campaign myself?

No. Microsoft deploys it automatically to all tenants starting October 5, 2026, prompting affected users and administrators without any configuration. What you do control is the separate Microsoft Authenticator registration campaign, which you can switch on earlier to move users onto stronger methods on your own schedule.

Can administrators register authentication methods on behalf of users?

Yes. Open the user in the Microsoft Entra admin center, go to Authentication methods, and add a phone number or email address directly. Admin-registered methods count as registered for SSPR, which makes this the practical route for users who never act on prompts.

Sources

• Microsoft Entra ID security updates: What organizations need to do now (Microsoft Entra blog)
• Microsoft Entra pushes passkeys, tightens identity security (Help Net Security)
• MC1325414: SSPR will require registered authentication methods (Message Center archive)

Three dates, three checks, one quiet afternoon of admin work. Put October 5 and November 9 in your calendar now and your users will barely notice anything changed. If you'd rather have someone else watch Microsoft's enforcement calendar, book a free IT assessment and we'll review your tenant against all three deadlines.