This sounds like a minor identity update — but it quietly removes a fallback many tenants still rely on today. And if your tenant still depends on them — this is not a “future change.” It’s a silent failure waiting to happen.
What changes
Microsoft is retiring security questions as an authentication method for Self-Service Password Reset (SSPR). Users depending on security questions only will lose password reset capability after retirement. No fallback. No alternative flow. No recovery path.
Retirement: March 2027
After this date:
- Users relying on security questions only
- Will lose the ability to reset passwords entirely
No workaround. No fallback. No exceptions.
Where this typically breaks
This is not about whether security questions are “enabled.” It’s about whether they are still implicitly depended on in your recovery flows. Most environments are affected through hidden dependencies:
- legacy SSPR configurations
- incomplete authentication method registration
- inconsistent MFA coverage across users
- forgotten fallback logic from older identity setups
What this becomes in production
This doesn’t show up as a clean error message. It shows up as:
- Password reset loops that fail silently
- Helpdesk spikes with no obvious root cause
- Users locked out despite “having MFA”
- Escalations that don’t reproduce consistently
And worst of all:
- It looks like instability — not a configuration issue
What replaces it
Modern authentication methods already available:
- Microsoft Authenticator (push / number matching)
- Authenticator app (TOTP / OATH)
- SMS / voice call
- Email verification
- Passkeys (recommended direction)
- Windows Hello for Business
Action for IT teams
What admins should do now — not in 2027. This is a cleanup exercise disguised as a retirement timeline. Start here:
- Identify users who still rely on security questions
- Validate full SSPR authentication method coverage
- Remove legacy fallback dependencies
- Enforce modern authentication registration policies
- Drive adoption of Authenticator + Passkeys
Because once this is retired:
- there is no recovery path left to configure
This is one of those identity changes that feels distant — until it suddenly becomes operational reality. And at that point, it’s already too late to “roll out a fix.”