Admin SSPR
I have one of these issues that I swear is going to be so easy to fix that once someone points out problem i am going to have to lie down because it was so obvious - I hope.
As per MS Zero Trust they recommend that you disable SSPR for admins via update-mgpolicyauthorizationpolicy -allowedtousesspr:$false. Which works great and can see that on portal.
However if I logon it tries to register me for SSPR as the password reset enabled is targeted to All. I can obviously fix this by excluding a user manually from a dynamic group but that is not very flexible. In checking you cannot trap an administrator directly (suggest automation to populate a group or use manual extension attribute).
The actual issue is it pops up the ‘you must register SSPR’ then says no available methods but allows you to skip.
Is there an obvious miss from me?