Block administrators from using SSPR

Maester checks this too

EIDSCA.AP01 (Default Authorization Settings - Enabled Self service password reset for administrators.) checks the same setting. Running both reports it twice.

Overview

Self-Service Password Reset (SSPR) for administrators allows password changes to happen without strong secondary authentication factors or administrative oversight. Threat actors who compromise administrative credentials can use this capability to bypass other security controls and maintain persistent access to the environment.

Once compromised, attackers can immediately reset the password to lock out legitimate administrators. They can then establish persistence, escalate privileges, and deploy malicious payloads undetected.

Remediation

• Disable SSPR for administrators by updating the authorization policy

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Low
Effort to fix	Low
Impact on users	Low
Pillar	Identity
Category	Access control
Product	Entra ID
Feature	User and directory settings
Area	Privileged access
ATT&CK	T1078.004 Cloud Accounts, T1531 Account Access Removal
Licence	P1
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.