Force a user to re-register with Azure AD Self Service Password Reset

%3CLINGO-SUB%20id%3D%22lingo-sub-308363%22%20slang%3D%22en-US%22%3ERe%3A%20Force%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-308363%22%20slang%3D%22en-US%22%3E%3CP%3EI%20Found%20A%20solution%20to%20this%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%23%20%2FMWU%3CBR%20%2F%3E%23%20First%20connect%20to%20your%20tenant%20(as%20you%20use%20to%20do%20it)%3CBR%20%2F%3E%23%20Output%20from%20my%20connect%20tenant%20function%3CBR%20%2F%3E%23%20cat%20function%3AConnect-O365-PROD%3C%2FP%3E%3CP%3E%23%20Actual%20Connect-O365-PROD%20function%3CBR%20%2F%3EGet-PSSession%20%7C%20Remove-PSSession%3CBR%20%2F%3E%24PROD365Session%20%3D%20New-PSSession%20-ConfigurationName%20Microsoft.Exchange%20-ConnectionUri%20%3CA%20href%3D%22https%3A%2F%2Fps.outlook.com%2Fpowershell-liveid%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fps.outlook.com%2Fpowershell-liveid%3C%2FA%3E%20-Credential%20%24PRODAdminCred%20-Authentication%20Basic%20-AllowRedirection%3CBR%20%2F%3E%23Use%20this%20if%20you%20import%20scriptfunctions%20from%20remote%20server%2C%20i%20only%20load%20remote%20script%20in%20my%20%24profile%3CBR%20%2F%3EImport-Module%20(Import-PSSession%20%24PROD365Session%20-AllowClobber)%20-global%3CBR%20%2F%3EConnect-MsolService%20-Credential%20%24PRODAdminCred%3CBR%20%2F%3E%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23Forget%20above%20if%20you%20are%20Pro%20%3A)%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%23Selected%20user%20in%20cloud%3CBR%20%2F%3E%24Userpricipalname%20%3D%20%22abc%40org.com%22%3C%2FP%3E%3CP%3E%23Get%20settings%20for%20a%20user%20with%20exsisting%20auth%20data%3CBR%20%2F%3E%24User%20%3D%20Get-MSolUser%20-UserPrincipalName%20%24Userpricipalname%3CBR%20%2F%3E%23%20Viewing%20default%20method%3CBR%20%2F%3E%24User.StrongAuthenticationMethods%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%23%20Creating%20custom%20object%20for%20default%20method%20(here%20you%20just%20put%20in%20%24true%20insted%20of%20%24false%2C%20on%20the%20prefeered%20method%20you%20like)%3CBR%20%2F%3E%24m1%3DNew-Object%20-TypeName%20Microsoft.Online.Administration.StrongAuthenticationMethod%3CBR%20%2F%3E%24m1.IsDefault%20%3D%20%24false%3CBR%20%2F%3E%24m1.MethodType%3D%22OneWaySMS%22%3C%2FP%3E%3CP%3E%24m2%3DNew-Object%20-TypeName%20Microsoft.Online.Administration.StrongAuthenticationMethod%3CBR%20%2F%3E%24m2.IsDefault%20%3D%20%24false%3CBR%20%2F%3E%24m2.MethodType%3D%22TwoWayVoiceMobile%22%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%24m3%3DNew-Object%20-TypeName%20Microsoft.Online.Administration.StrongAuthenticationMethod%3CBR%20%2F%3E%24m3.IsDefault%20%3D%20%24false%3CBR%20%2F%3E%24m3.MethodType%3D%22PhoneAppOTP%22%3C%2FP%3E%3CP%3E%3CBR%20%2F%3E%24m4%3DNew-Object%20-TypeName%20Microsoft.Online.Administration.StrongAuthenticationMethod%3CBR%20%2F%3E%24m4.IsDefault%20%3D%20%24True%3CBR%20%2F%3E%24m4.MethodType%3D%22PhoneAppNotification%22%3C%2FP%3E%3CP%3E%23%20To%20set%20the%20users%20default%20method%20for%20doing%20second%20factor%3CBR%20%2F%3E%23%24m%3D%40(%24m1%2C%24m2%2C%24m3%2C%24m4)%3C%2FP%3E%3CP%3E%23%20To%20force%20user%20ONLY%20to%20re-register%20without%20clearing%20their%20phonenumber%20or%20App%20shared%20secret.%3CBR%20%2F%3E%24m%3D%40()%3C%2FP%3E%3CP%3E%23%20Set%20command%20to%20define%20new%20settings%3CBR%20%2F%3Eset-msoluser%20-Userprincipalname%20%24user.UserPrincipalName%20-StrongAuthenticationMethods%20%24m%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%23Settings%20should%20be%20empty%2C%20and%20user%20is%20required%20to%20register%20new%20phone%20number%20or%20whatever%20they%20like%2C%20i%20case%20they%20lost%20their%20phone.%3CBR%20%2F%3E%24User%20%3D%20Get-MSolUser%20-UserPrincipalName%20%24Userpricipalname%3CBR%20%2F%3E%24User.StrongAuthenticationMethods%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-210853%22%20slang%3D%22en-US%22%3ERe%3A%20Force%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-210853%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F63022%22%20target%3D%22_blank%22%3E%40Han%20Valk%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20was%20trying%20to%20do%20the%20same%20task%2C%20force%20a%20user%20to%20re-register%20for%20SSPR%20in%20a%20lab%20tenant.%26nbsp%3B%20I%20was%20able%20to%20do%20so%20by%20removing%20values%20from%20the%20AAD%20user.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EGet-MsolUser%20-UserPrincipalName%20user%40domain.com%20%7C%20select%20AlternateEmailAddresses%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EGet-MsolUser%20-UserPrincipalName%20user%40domain.com%20%7C%20select%20MobilePhone%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EGet-MsolUser%20-UserPrincipalName%20user%40domain.com%20%7C%20select%20PhoneNumber%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EAfter%20I%20removed%20data%20from%20all%203%20properties%2C%20the%20user%20could%20no%20longer%20do%20SSPR.%26nbsp%3B%20When%20the%20user%20goes%20to%20%3CA%20href%3D%22https%3A%2F%2Faka.ms%2Fssprsetup%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Faka.ms%2Fssprsetup%3C%2FA%3E%2C%20they%20are%20prompted%20to%20register%20(after%20a%20successful%20sign-in).%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-161113%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Force%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-161113%22%20slang%3D%22en-US%22%3E%3CP%3EYes%2C%20I%20understand.%3CBR%20%2F%3EDo%20you%20agree%20with%20Ruud%20Gijsbers%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-160757%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Force%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-160757%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Han%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWithin%20the%20MFA%20configuration%2C%20there%20is%20an%20option%20to%20require%20selected%20users%20to%20provide%20contact%20methods%20again.%20As%20far%20as%20i%20can%20see%2C%20the%20user%20doesn't%20have%20be%20MFA%20enabled.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWithin%20%3CA%20href%3D%22https%3A%2F%2Faad.portal.azure.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Faad.portal.azure.com%3C%2FA%3E%20go%20to%20Users.%20On%20the%20top%20of%20the%20page%2C%20you%20can%20go%20to%20Multi-Factor%20Authentication.%20A%20new%20page%2Ftab%20will%20be%20opened.%20On%20that%20page%20you%20can%20select%20the%20user%20%3D%26gt%3B%20Manage%20User%20Settings%20%3D%26gt%3B%20place%20a%20check%20mark%20at%20%3CEM%3ERequire%20selected%20users%20to%20provide%20contact%20methods%20again%20%3C%2FEM%3E%20and%20click%20save.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHope%20this%20helps.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBest%20regards%2C%3C%2FP%3E%0A%3CP%3ERuud%20Gijsbers%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-160721%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Force%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-160721%22%20slang%3D%22en-US%22%3E%3CP%3EMy%20question%20has%20nothing%20to%20do%20with%20password%20expiring.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-91529%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Force%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-91529%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EReview%20your%20eligible%20accounts.%3CBR%20%2F%3EGet-MsolUser%20-UserPrincipalName%20admin%40soft.onmicrosoft.com%20%7C%20select%20PasswordNeverExpires%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMore%20about%20passwords%20and%20password%20expiration%20policies%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FChange-how-often-passwords-expire-in-Office-365-for-Small-Business-d479e71a-f59d-4b2c-9036-755f7b0ff7cf%3Fomkt%3Den-US%26amp%3Bui%3Den-US%26amp%3Brs%3Den-US%26amp%3Bad%3DUS%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FChange-how-often-passwords-expire-in-Office-365-for-Small-Business-d479e71a-f59d-4b2c-9036-755f7b0ff7cf%3Fomkt%3Den-US%26amp%3Bui%3Den-US%26amp%3Brs%3Den-US%26amp%3Bad%3DUS%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-91479%22%20slang%3D%22en-US%22%3ERE%3A%20Force%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-91479%22%20slang%3D%22en-US%22%3EClearing%20the%20attributes%20like%20Vasil%20suggested%20does%20not%20force%20a%20user%20to%20re-register.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-90421%22%20slang%3D%22en-US%22%3ERe%3A%20Force%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-90421%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Han%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDid%20you%20tried%20following%20by%20clearing%20the%20user%20data%20what%20Vasil%20suggested%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-passwords-data%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-passwords-data%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMay%20be%20a%20new%20user%20you%20could%20try%20and%20test.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-89435%22%20slang%3D%22en-US%22%3ERe%3A%20Force%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-89435%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20can%20clear%20the%20SSPR%20data%20via%20PowerShell%2C%20the%20relevant%20attributes%20are%20listed%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-passwords-data%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-passwords-data%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-89399%22%20slang%3D%22en-US%22%3ERe%3A%20Force%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-89399%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20they%20have%20not%20registered%2C%20re-registration%20does%20not%20seem%20applicable%20to%20me%20so%20I'm%20a%20little%20bit%20confused%20by%20your%20question%2C%20but%20you%20may%20find%20this%20helpful%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-passwords-data%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Factive-directory-passwords-data%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-89397%22%20slang%3D%22en-US%22%3EForce%20a%20user%20to%20re-register%20with%20Azure%20AD%20Self%20Service%20Password%20Reset%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-89397%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20there%20a%20way%20to%20force%20a%20user%20to%20re-register%20with%20the%20Azure%20AD%20Self%20Service%20Password%20Reset%26nbsp%3Bas%20if%26nbsp%3Bhe%2Fshe%20has%20never%20registered%20before%3F%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20to%20remove%26nbsp%3Bthe%20registration%20of%20a%20specific%20user%20or%20re-initialise%20a%20specific%20user%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-89397%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Highlighted
Occasional Contributor

Is there a way to force a user to re-register with the Azure AD Self Service Password Reset as if he/she has never registered before?

Is there a way to remove the registration of a specific user or re-initialise a specific user?

 

 

10 Replies
Highlighted

If they have not registered, re-registration does not seem applicable to me so I'm a little bit confused by your question, but you may find this helpful https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-data

 

Highlighted

You can clear the SSPR data via PowerShell, the relevant attributes are listed here: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-data

 

 

Highlighted

Hi Han,

 

Did you tried following by clearing the user data what Vasil suggested?

 

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-data

 

May be a new user you could try and test. 

 

Highlighted
Clearing the attributes like Vasil suggested does not force a user to re-register.
Highlighted

Hi !

 

Review your eligible accounts.
Get-MsolUser -UserPrincipalName admin@soft.onmicrosoft.com | select PasswordNeverExpires

 

More about passwords and password expiration policies
https://support.office.com/en-us/article/Change-how-often-passwords-expire-in-Office-365-for-Small-B...

 

Highlighted

My question has nothing to do with password expiring.

Highlighted

Hi Han,

 

Within the MFA configuration, there is an option to require selected users to provide contact methods again. As far as i can see, the user doesn't have be MFA enabled.

 

Within https://aad.portal.azure.com go to Users. On the top of the page, you can go to Multi-Factor Authentication. A new page/tab will be opened. On that page you can select the user => Manage User Settings => place a check mark at Require selected users to provide contact methods again and click save.

 

Hope this helps.

 

Best regards,

Ruud Gijsbers

Highlighted

Yes, I understand.
Do you agree with Ruud Gijsbers?

Highlighted

@Han Valk

 

I was trying to do the same task, force a user to re-register for SSPR in a lab tenant.  I was able to do so by removing values from the AAD user.

 

Get-MsolUser -UserPrincipalName user@domain.com | select AlternateEmailAddresses

Get-MsolUser -UserPrincipalName user@domain.com | select MobilePhone

Get-MsolUser -UserPrincipalName user@domain.com | select PhoneNumber

 

After I removed data from all 3 properties, the user could no longer do SSPR.  When the user goes to https://aka.ms/ssprsetup, they are prompted to register (after a successful sign-in).

Highlighted

I Found A solution to this :)

 

# /MWU
# First connect to your tenant (as you use to do it)
# Output from my connect tenant function
# cat function:Connect-O365-PROD

# Actual Connect-O365-PROD function
Get-PSSession | Remove-PSSession
$PROD365Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell-liveid -Credential $PRODAdminCred -Authentication Basic -AllowRedirection
#Use this if you import scriptfunctions from remote server, i only load remote script in my $profile
Import-Module (Import-PSSession $PROD365Session -AllowClobber) -global
Connect-MsolService -Credential $PRODAdminCred
##################Forget above if you are Pro :)#######################################


#Selected user in cloud
$Userpricipalname = "abc@org.com"

#Get settings for a user with exsisting auth data
$User = Get-MSolUser -UserPrincipalName $Userpricipalname
# Viewing default method
$User.StrongAuthenticationMethods

 


# Creating custom object for default method (here you just put in $true insted of $false, on the prefeered method you like)
$m1=New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationMethod
$m1.IsDefault = $false
$m1.MethodType="OneWaySMS"

$m2=New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationMethod
$m2.IsDefault = $false
$m2.MethodType="TwoWayVoiceMobile"


$m3=New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationMethod
$m3.IsDefault = $false
$m3.MethodType="PhoneAppOTP"


$m4=New-Object -TypeName Microsoft.Online.Administration.StrongAuthenticationMethod
$m4.IsDefault = $True
$m4.MethodType="PhoneAppNotification"

# To set the users default method for doing second factor
#$m=@($m1,$m2,$m3,$m4)

# To force user ONLY to re-register without clearing their phonenumber or App shared secret.
$m=@()

# Set command to define new settings
set-msoluser -Userprincipalname $user.UserPrincipalName -StrongAuthenticationMethods $m

 

#Settings should be empty, and user is required to register new phone number or whatever they like, i case they lost their phone.
$User = Get-MSolUser -UserPrincipalName $Userpricipalname
$User.StrongAuthenticationMethods