Tip: if a phone call plus an SMS code can reset a password and add a new Authenticator, close that path
- Move off SMS and voice: in the Entra authentication methods policy, prefer phishing-resistant methods (passkeys/FIDO2, Windows Hello) and Authenticator, and remove SMS/voice as SSPR and MFA methods for privileged and finance users first.
- Protect security-info registration: use the Conditional Access template that requires a trusted location or compliant device (or a Temporary Access Pass) to register security info, so a fresh session from an unknown device can't add a method.
- Alert on the pair: a password reset followed within minutes by a new authentication method should page someone; review Entra audit logs for both events on the same user.
- Help desk: require out-of-band identity verification before any reset or method change requested by phone.
Sources: Microsoft Learn: Manage authentication methods for Microsoft Entra ID · Microsoft Learn: Securing security info registration with Conditional Access · Microsoft Learn: Plan a Microsoft Entra self-service password reset deployment · Microsoft Threat Intelligence on X: Storm-3350 (Nov 10, 2026)