Microsoft's public Entra ID password-reset portal leaks account existence, registered MFA methods and likely-admin status to any unauthenticated visitor
A public tool bulk-enumerates Entra ID accounts and their MFA methods through Microsoft's own password-reset portal
Analysis
Microsoft's Self-Service Password Reset (SSPR) portal, publicly reachable at passwordreset.microsoftonline.com with no prior authentication, discloses more than it is meant to about the accounts behind it (LevelBlue SpiderLabs, 2026-09-23). Submitting an email address triggers an ASP.NET UpdatePanel POST, and the server's reply carries a hidden CurrentViewName field that tells an attacker exactly what happened server-side: ViewMultigateUserControl means the account exists and SSPR advanced to method selection, while a genuine not-found bounces back to ViewUserIdentifierVerification. Every other named view, including the documented error codes SSPR_0011 (no password reset policy defined for the user) and SSPR_0013 (the user is not a member of the group enabled for SSPR), still confirms the account exists, because the server only reaches those policy checks after resolving the username in the directory: "The server only reaches those policy checks after successfully resolving the username in the directory" (LevelBlue SpiderLabs, 2026-09-23). For an account that reaches the method-selection screen, the response HTML lists every registered second factor as visible radio buttons, with unregistered methods present in the DOM but hidden, so an attacker also learns whether a target relies on an authenticator app, SMS, or a more easily phished alternate-email one-time code.
The technique's sharpest edge is administrator identification. Microsoft enforces SSPR for admin accounts regardless of the tenant-wide SSPR policy, so in a tenant that has disabled SSPR for standard users, any account that still reaches method selection is likely a privileged role account, and its registered factors are exposed the same way: "Admin accounts bypass this check entirely and proceed to method enumeration regardless" (LevelBlue SpiderLabs, 2026-09-23). This turns a list of candidate email addresses harvested from a company website, LinkedIn, or a data breach into a confirmed target list, ranked by which accounts have the weakest second factor, before any credential attack begins. Microsoft removed the portal's visual CAPTCHA in August 2026, replacing it with backend throttling and behavioural abuse detection rather than a challenge the user must solve (LevelBlue SpiderLabs, 2026-09-23). The researcher released a public automation tool, ResetSpy, that scripts bulk lookups with rotating user agents and randomised timing to reduce fingerprinting.
Cited evidence
Importantly, every non-"ViewUserIdentifierVerification" response (including "SSPR_0011", "SSPR_0013", and the guest/federated not-available response) is confirmation that the account exists. The server only reaches those policy checks after successfully resolving the username in the directory.
Microsoft enforces SSPR for administrator accounts regardless of the tenant-wide SSPR policy. If an organization has disabled SSPR for standard users, standard accounts return "ViewSsprNotEnabledInUserPolicy" (SSPR_0011). Admin accounts bypass this check entirely and proceed to method enumeration regardless.
As of August 2026, Microsoft removed this CAPTCHA entirely and replaced it with backend throttling and behavior-based abuse detection
Updates2
LevelBlue recommends scoping SSPR to a security group but also finds that "Scoped SSPR, counterintuitively, leaks more information about the accounts that are inside the group than a blanket disabled policy does", because those accounts proceed to method enumeration (LevelBlue SpiderLabs, 2026-09-23). Scoping limits method disclosure for accounts outside the group; every account still has its existence confirmed, and accounts inside the group, including those with no registered method, are exposed in full.
ResetSpy does not report administrator status. For each target it returns whether the account exists, which SSPR verification methods are registered, whether those methods amount to a meaningful second factor or are weak-only, and the SSPR policy state (LevelBlue SpiderLabs, 2026-09-23). Likely administrators are an inference from that policy state: in a tenant that has disabled SSPR for standard users, an account that still reaches method selection "is likely a privileged role account" (LevelBlue SpiderLabs, 2026-09-23).
Sources1
Revision history
- Published 2026-09-24T0405Z-intel
- Correction 2026-10-11T1307Z-audit
The takeaway recommended scoping SSPR to a group without LevelBlue's own caveat that scoped SSPR leaks more about the accounts inside the group; the caveat is added. Microsoft replaced the CAPTCHA with backend throttling and behavior-based abuse detection, not throttling alone; LevelBlue says a privileged account is 'likely', not 'very likely'; the detection, triage and takeaway lines gain their LevelBlue citation.
Changed: summary body
- Improvement 2026-10-21T0800Z-audit
The headline no longer says ResetSpy enumerates admin status: the tool reports account existence, registered methods, their strength and the SSPR policy state, and likely administrators are inferred from that policy state. The takeaway now says scoping SSPR to a group limits method disclosure to in-group accounts and administrators without stopping existence enumeration, instead of presenting it as shrinking the enumerable population.
Changed: body headline summary
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.