Microsoft Entra ID
AuthenticationRegistration Mfa Sspr Combined
In brief
The documentation now lists certificate-based authentication, FIDO2 passkeys, and Microsoft Authenticator passwordless phone sign-in notifications as methods users can use to change their cloud password without entering their current password.
What Entra admins need to know
Review password-change guidance for users who use passwordless authentication methods.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
A user navigates to Security info. After signing in, the user can change their password. If the user authenticates with a password and a multifactor authentication method, they can change their password without entering their existing password.
An organization can also allow users to change their cloud password after they authenticatesign in with Microsoft Entra certificate-based authentication (CBA), a registered passkey (FIDO2), or Windows Hello for Business credential.a Microsoft Authenticator passwordless phone sign-in notification. Users don't need to know or enter their current password orpassword, and they don't need to be registered for SSPR. For administrator configuration, user steps, and limitations, see Change a password with passwordless authentication.
Authentication methods such as Temporary Access Pass (TAP) aren't supported for password change unless the user knows their existing password.
@@ -134,7 +134,7 @@ Organizations can modify the authentication requirements by defining [Conditiona A user navigates to [Security info](https://aka.ms/mysecurityinfo). After signing in, the user can change their password. If the user authenticates with a password and a multifactor authentication method, they can change their password without entering their existing password. -An organization can also allow users to change their cloud password after they authenticate with a registered passkey (FIDO2) or Windows Hello for Business credential. Users don't need to know their current password or be registered for SSPR. For administrator configuration, user steps, and limitations, see [Change a password with passwordless authentication](concept-sspr-howitworks.md#tab/passwordless).+An organization can also allow users to change their cloud password after they sign in with Microsoft Entra certificate-based authentication (CBA), a passkey (FIDO2), or a Microsoft Authenticator passwordless phone sign-in notification. Users don't need to know or enter their current password, and they don't need to be registered for SSPR. For administrator configuration, user steps, and limitations, see [Change a password with passwordless authentication](concept-sspr-howitworks.md#tab/passwordless). Authentication methods such as Temporary Access Pass (TAP) aren't supported for password change unless the user knows their existing password.