Phase 7 of 11
Security Baseline: MFA and SSPR
Overview
What was built
Smart Lockout's threshold was reduced from ten failed attempts to five, and the lockout duration extended from sixty to a hundred and twenty seconds, so a brute-force attempt locks out faster and attackers wait longer between tries. MFA registration was scoped to SG-All-Employees, prompting every internal user to register a method on their next sign-in. This phase registers users for MFA; it does not yet enforce MFA on every sign-in, that enforcement is Phase 8's job through Conditional Access.
How it works
The walkthrough
Step 1 of 1
Rolling out SSPR and hitting a real hybrid limitation
Enabled self-service password reset for SG-All-Employees, with email OTP and SMS both available as authentication methods. Testing SSPR with Steve Rogers, a cloud-only user, completed successfully on the first try.
Testing the same flow with Phil Coulson, a hybrid user synced from on-premises AD, returned a real error: "Password writeback isn't turned on for your organization." Password changes made in the cloud cannot reach an on-premises AD account without writeback explicitly enabled on Entra Connect, and STARK-DC01 did not have that configured yet. The scope was rolled back to SG-All-Employees for cloud-only testing, and password writeback was documented as a fix for when the domain controller was available, which is exactly what happened once Phase 8 exposed the same gap from a different angle.
What went wrong
Honest account
SSPR surfaced a real hybrid identity limitation immediately. It worked for a cloud-only test user on the first attempt, but a hybrid user hit a genuine password writeback error, since password changes made in the cloud cannot reach an on-premises AD account without writeback explicitly enabled on Entra Connect.