My break-glass accounts can sign in with FIDO2 keys, but then get redirected to a page asking them to register another security method. They are excluded from Conditional Access policies, and I set SSPR registration to disabled for these accounts. What setting should I check?
Why does my break-glass account still get sent to security info setup?
Asked by
S9__Rummage
Answers
Check the SSPR scope itself, not just the setting that controls whether users can use SSPR. If SSPR is limited to a group, make sure the break-glass accounts are not members of that group. Review the tenant's registration prompts and scope together, since changing one setting may not remove a prompt caused by another.
Reply to this answer
FIDO2 sign-in and SSPR are separate things. A FIDO2 key can satisfy authentication without necessarily counting as an alternate SSPR method, so forcing FIDO2 for sign-in may not clear a requirement to add recovery information. Check the SSPR configuration and the account's registration requirements rather than changing the FIDO2 policy alone.
Reply to this answer
For emergency accounts, keep the setup minimal and test it end to end after changing policy. If you use group-scoped SSPR, keep these accounts out of the enabled group, then verify the actual sign-in flow in a private browser session. Also confirm the prompt is for SSPR registration and not a different security-info or registration policy.
Reply to this answer
Add your answer
Answers are reviewed before publication.
S9__Rummage:
That was the piece I had missed. I was checking the general SSPR setting but not the scope used to decide who gets prompted.