SSPR registration enforcement with Combined Registration Enabled

[DTunes]

Hi,

We have the Combined Registration for MFA and SSPR enabled as described here,

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-registration-mfa-sspr... and now we would like to enforce SSPR & MFA registration through the SSPR setting (in AAD under Password reset | Registration) Require users to register when signing in.

However this same page states "SSPR registration enforced: Users are asked to register during sign-in. They register only SSPR methods.", which confuses me. If you have enabled a combined registration experience I want to believe that regardless of how the registration is enforced the authentication methods registered by the user will be valid for both MFA & SSPR.

Can anyone positively confirm that with Combined Registration enabled AND SSPR Registration enforcement, the authentication methods registered can also be used for MFA?

Thanks!

[#2]

I was not aware of this selection. We usually force registration of all users with portal.azure.com > Azure Active Directory > Password > Registration. However, that is all or nothing.

We also often use Conditional Access ans only require MFA on certain scenarios (like external access) that will kick off the combined MFA/SSPR registration. This can be applied to a group so you only force a few users at a time.

But would be interesting to see if this works since then you can really stage registration for a few users at a time.

[#3]

We have tested the registration enforcement through the MFA Registration Policy, in Azure AD, under Security->Identity Protection->MFA Registration, that works really well. You can target it at specific users via AAD groups. The only issue for us is that by default it gives users only 14 days to register, after that they cannot skip it anymore and are forced to do it.
The old SSPR registration enforcement actually allowed people to continue to skip the registration indefinitely, something we actually want.

[#4]

I agree on the MFA Registration works well too, just notice that you need Azure AD Premium P2 for this.