M365 Roundup, March 2022: MFA and SSPR Registration Become One Experience
TL;DR
- Microsoft is making the combined MFA and SSPR registration experience the default for all Azure AD tenants, rolling out from early October 2022 through early January 2023.
- The combined registration change does not force users into MFA; enforcement still comes from Conditional Access policies, the MFA portal, or PowerShell.
- As of March 2022, partners have seven calendar days instead of 72 hours to cancel or reduce seats on new commerce subscriptions in CSP.
- Exchange Online dynamic distribution group membership moves from per-send calculation to a stored list refreshed every 24 hours, viewable with Get-DynamicDistributionGroupMember.
- Five Microsoft 365 nonprofit SKUs increase in price globally on September 1, 2022, with grant offers unaffected.
The headline from March 2022 is an identity change with a long fuse: combined MFA and SSPR registration becomes the default for every tenant, which means user-facing screens change and help desks should know it is coming. Around it, NCE picks up a friendlier cancellation window, nonprofits get a price increase with a September date, and Exchange quietly rebuilds how dynamic distribution groups resolve. Here is the full MSP-relevant list.
Identity and admin
Combined security information registration becomes the default (end user impact)
The combined registration experience for MFA and self-service password reset shipped as an opt-in back in April 2020. Microsoft is now making it the default for all tenants. Registration for both happens in one flow hosted on the My Sign-ins page instead of two separate experiences, which cuts the number of times users have to register security information. The combined experience documentation (opens in new tab) covers the details.
The key point for MSPs fielding questions: this change does not force anyone into MFA. Enforcement is still controlled by Conditional Access policies and the MFA portal, or PowerShell.
To prepare users, Microsoft suggests building training on the end-user setup documentation (opens in new tab) and the additional security verification page (opens in new tab).
To review your current setting and enable combined registration ahead of the rollout:
- Sign in to the Azure portal as a user administrator or global administrator.
- Go to Azure Active Directory, then User settings, then Manage user feature settings.
- Under "Users can use the combined security information registration experience," enable for All users.
Rollout: early October 2022, expected complete by early January 2023.
NCE cancellation window grows from 72 hours to 7 days (feature enhancement)
Partners now have seven calendar days, up from 72 hours, to cancel or reduce seats after ordering or renewing new commerce subscriptions in CSP. Details in the Partner Center announcement (opens in new tab).
Rollout: generally available.
Nonprofit pricing increases September 1, 2022 (price increase)
Microsoft is raising prices on five Microsoft 365 nonprofit SKUs for new and existing nonprofit customers:
- Office 365 E1: from 2.00 to 2.50 USD
- Office 365 E3: from 4.50 to 5.75 USD
- Office 365 E5: from 14.00 to 15.20 USD
- Microsoft 365 E3: from 8.00 to 9.00 USD
- Microsoft 365 Business Premium: from 5.00 to 5.50 USD
The increase applies globally and does not affect any offers available as grants. Full details in the Partner Center announcement (opens in new tab).
Effective: September 1, 2022.
Exchange: dynamic distribution groups stop guessing
Today, a dynamic distribution group calculates its membership every time a message is sent, based on the filters defined for the group. Complex filters mean slow calculation, delayed mail, and in extreme cases reliability problems. And because membership only resolves at send time, the sender never knows the actual recipient list, which raises compliance questions.
What changes: instead of real-time calculation, Exchange Online stores the membership list for each dynamic distribution group and refreshes it every 24 hours.
The benefits: you can be certain of the recipient list before a message is sent, and you can view members with the Get-DynamicDistributionGroupMember cmdlet. Storing the calculated list on the group object also speeds delivery and improves reliability.
One caveat: when you create a new dynamic distribution group or modify a group's filters, it can take up to 2 hours before the group is ready for first use.
Rollout: early April 2022, expected complete by mid-April.
Teams: automation, devices, and casting
Workflows arrive in the Teams app store (new feature)
Workflows automate repetitive tasks or processes that connect one or more apps to Teams. Users can browse, add, and manage them from the Teams store and from several other contexts within Teams. Many workflows run automatically once configured; others can be triggered manually from the messaging area or from individual messages.
Availability is governed by Power Automate access: current Power Automate settings are honored, and admins can switch the capability off with an app permission policy or by blocking Power Automate from the Manage apps page.
Rollout: mid-March 2022, fully deployed by end of March.
A device store inside the Teams admin center (new feature)
Admins can explore and purchase certified Teams devices directly from the Teams admin center. A new "Device store" entry appears in the left navigation, collecting all Teams certified devices in a single place with provisioning built in.
Rollout: early April 2022, expected complete by mid-April.
Cast from the Teams desktop client to a Teams Room (new feature)
For quick ad-hoc sessions that do not justify a formal meeting, users can wirelessly connect to a Teams Room from the Teams desktop client on Windows and Mac, share their screen, and cast content stored locally or accessible via Office 365.
Rollout: mid-March 2022, expected complete by late April.
Frequently asked questions
How do you turn on combined security information registration before it becomes the default?
Sign in to the Azure portal as a user administrator or global administrator, go to Azure Active Directory, then User settings, then Manage user feature settings, and enable the combined security information registration experience for All users.
Why do new dynamic distribution groups take up to 2 hours to work?
Because membership is now stored rather than calculated per message, a newly created group, or one whose filters you modify, can take up to 2 hours before it is ready for first use. After that, the stored list refreshes every 24 hours.
Which nonprofit SKUs are increasing in price on September 1, 2022?
Office 365 E1 from 2.00 to 2.50 USD, Office 365 E3 from 4.50 to 5.75, Office 365 E5 from 14.00 to 15.20, Microsoft 365 E3 from 8.00 to 9.00, and Microsoft 365 Business Premium from 5.00 to 5.50.
Defaults change. Your baselines should notice.
Microsoft moved a registration default; tomorrow it will be something else. CloudCapsule watches 250+ controls across every tenant so a quietly changed default never drifts past you.
Run a free scan
Written by
Nick Ross
CEO · Microsoft MVP · Founder, T-Minus 365
Nick is not just a CEO, he's a respected thought leader and influencer in the MSP space. Tens of thousands of MSPs learn through his YouTube channel, T-Minus365. Nick has been honored as a three-time Microsoft MVP for his educational content; his expertise and influence are the backbone of our mission, ensuring that you are in the best hands when it comes to security.
Nick joined Pax8 in 2017, where he would ultimately oversee product management for PSA and Microsoft integrations. Following his tenure at Pax8, Nick has continued to demonstrate his leadership prowess as an executive at various MSPs, culminating in his most recent role at Sourcepass.
Nick holds a Bachelor's Degree in Business Management from Florida State University, as well as a Minor Degree in Entrepreneurship. In his free time, Nick is an avid hiker, reader, and fitness-junkie.
