Microsoft SSPR Portal Leaks Account Details Without Authentication
Microsoft's Self-Service Password Reset portal exposes valid usernames and registered recovery methods to unauthenticated requestors, violating the principle of least privilege at the authentication boundary. This information disclosure flaw allows attackers to enumerate valid accounts and identify likely administrator targets without any credentials. The leaked recovery method details (e.g., masked email or phone) provide a roadmap for highly convincing phishing and social engineering campaigns. This matters because account enumeration is often the critical first step in credential-based attacks, and exposing admin accounts significantly elevates organizational risk. Organizations relying on SSPR as a security convenience feature may unknowingly be broadening their attack surface.
Tactical Insight
Immediate actions
- Audit your Microsoft tenant's SSPR configuration and restrict access to the portal to authenticated or corporate-network users only.
- Review which accounts have SSPR enabled and ensure administrator accounts are excluded or use hardened recovery workflows.
Long-term improvements
- Enforce conditional access policies that limit SSPR portal access by location, device compliance, and identity risk score.
- Implement a privileged account management (PAM) strategy that separates admin account recovery flows from standard user SSPR.
- Regularly review and harden identity-related portal configurations as part of a recurring cloud security posture management (CSPM) process.
Detection measures
- Enable and monitor Azure AD sign-in and audit logs for unusual SSPR enumeration patterns or high-volume unauthenticated requests.
- Configure alerts for repeated SSPR attempts against accounts flagged as sensitive or administrative in your identity protection tooling.