---
title: Tip: if a phone call plus an SMS code can reset a password and add a new Authenticator, close that path | ctxsec
url: https://ctxsec.com/items/tip-harden-sspr-and-mfa-registration-against-storm-3350-style-takeover
description: "Storm-3350's whole takeover runs through two legitimate features: self-service password reset that accepts SMS or voice codes, and users registering new MFA methods right after sign-in. Tightening both removes the attacker's persistence step."
status: "operational guidance (Microsoft Entra documentation), prompted by Microsoft's Storm-3350 report"
published: 2026-11-10
---

> Storm-3350's whole takeover runs through two legitimate features: self-service password reset that accepts SMS or voice codes, and users registering new MFA methods right after sign-in. Tightening both removes the attacker's persistence step.

[← Tips & Guides](/tips) · [markdown](/items/tip-harden-sspr-and-mfa-registration-against-storm-3350-style-takeover.md)

operational guidance (Microsoft Entra documentation), prompted by Microsoft's Storm-3350 report

2026-11-10

### Tip: if a phone call plus an SMS code can reset a password and add a new Authenticator, close that path

- **Move off SMS and voice:** in the Entra authentication methods policy, prefer phishing-resistant methods (passkeys/FIDO2, Windows Hello) and Authenticator, and remove SMS/voice as SSPR and MFA methods for privileged and finance users first.
- **Protect security-info registration:** use the Conditional Access template that requires a trusted location or compliant device (or a Temporary Access Pass) to register security info, so a fresh session from an unknown device can't add a method.
- **Alert on the pair:** a password reset followed within minutes by a new authentication method should page someone; review Entra audit logs for both events on the same user.
- **Help desk:** require out-of-band identity verification before any reset or method change requested by phone.

Sources: [Microsoft Learn: Manage authentication methods for Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-manage) · [Microsoft Learn: Securing security info registration with Conditional Access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-security-info-registration) · [Microsoft Learn: Plan a Microsoft Entra self-service password reset deployment](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-sspr-deployment) · [Microsoft Threat Intelligence on X: Storm-3350 (Nov 10, 2026)](https://x.com/MsftSecIntel/status/2120290394869006572)