Full Report
Microsoft's Self-Service Password Reset (SSPR) portal is a legitimate feature designed to let users recover their accounts without calling the helpdesk. As it turns out, it also tells you quite a lot about the accounts in a tenant — whether they exist, what authentication methods they have registered, and in some cases, which ones are likely administrators. This post covers what the portal leaks, why it matters from both sides, and what defenders can do about it.
Analysis Summary
# Tool/Technique: Microsoft SSPR Portal Abuse (Cloud User and MFA Enumeration)
## Overview
This technique involves abusing Microsoft's legitimate Self-Service Password Reset (SSPR) portal to perform targeted user enumeration and discover registered Multi-Factor Authentication (MFA) methods. By analyzing the server's responses to authentication requests, threat actors can validate account existence, map out authentication methods, and identify potential administrator accounts within a target Microsoft Entra ID (Azure AD) tenant.
## Technical Details
- **Type:** Technique
- **Platform:** Cloud (Microsoft Entra ID / Microsoft 365)
- **Capabilities:** User account validation, MFA factor mapping, administrative account identification.
- **First Seen:** Documented publicly in September 2026.
## MITRE ATT&CK Mapping
- [TA0007 - Discovery]
- [T1087 - Account Discovery]
- [T1087.004 - Cloud Account]
## Functionality
### Core Capabilities
- **Account Existence Validation:** Sends automated asynchronous POST requests to the SSPR portal endpoint to determine if an email address exists. It identifies valid accounts by parsing the hidden `CurrentViewName` field in the ASP.NET UpdatePanel response.
- **Error Code Interpretation:** Maps specific server response states to Microsoft SSPR error codes (e.g., `ViewSsprNotEnabledInUserPolicy`, `ViewUserNotMemberOfScopedAccessGroup`, `ViewUserNotEnabled`), all of which implicitly confirm the account's existence regardless of whether password reset is permitted.
- **MFA Method Enumeration:** Extracts the `MultigateAuthenticationControl_RadioTable` from the response DOM for valid accounts to identify all registered second-factor authentication methods (e.g., authenticator apps, phone numbers, alternate emails), even those hidden from standard user visibility via CSS (`display:none`).
### Advanced Features
- **Administrative Account Identification:** Infers high-privilege or administrator roles based on the presence of specific SSPR policy blocks, distinct error behaviors, or configurations unique to privileged accounts within the target tenant.
## Indicators of Compromise
- **File Hashes:** N/A (Infrastructure/Technique-based)
- **File Names:** N/A
- **Registry Keys:** N/A
- **Network Indicators:**
- `passwordreset[.]microsoftonline[.]com` (Target legitimate portal)
- **Behavioral Indicators:**
- High volumes of HTTP POST traffic directed at the SSPR endpoint containing diverse username arrays from a single source or coordinated proxy networks.
- Automated generation of rapid, sequential session cookies coupled with matching `__VIEWSTATE` and `__EVENTVALIDATION` values.
## Associated Threat Actors
- Initial Access Brokers (IABs)
- Opportunistic threat actors conducting pre-attack reconnaissance.
- Advanced Persistent Threats (APTs) targeting cloud infrastructure.
## Detection Methods
- **Signature-based detection:** N/A
- **Behavioral detection:**
- Monitoring Entra ID logs for an anomalous spike in password reset attempts or failures across multiple distinct usernames.
- Tracking telemetry for rapid succession requests requesting the `ViewMultigateUserControl` web view from unusual geographic locations or known residential proxy ranges.
## Mitigation Strategies
- **Scoped SSPR Deployment:** Restrict the SSPR feature to a specific, well-defined group of users rather than enabling it globally across the entire tenant.
- **Monitoring Feature Updates:** Ensure visibility into Microsoft SSPR CAPTCHA protections and continuous anti-bot adjustments (such as MC1400824 updates).
- **Strong Authentication Enforcement:** Transition users toward phishing-resistant MFA methods (like FIDO2 security keys) to minimize the risk exposure from enumerated telephony or app-based factors.
## Related Tools/Techniques
- MSOLSpray
- o365recon
- TeamsPhisher
- Azure AD User Enumeration techniques