Self Service Password Reset - User Management

[petben]

I have setup Azure Self service password reset for a test group of students. It works fine, asks for authentication methods (phone etc) but any kind of post setup admin on a user, such as clearing out their mobile number or selecting 'Require re-register MFA' or 'Revoke MFA sessions' does not seem to do anything. They just log in fine without any prompt. If I clear the mobile number from a user (like we would if they changed their phone) and they choose 'forgotten password' when they login it says "You can't reset your own password because you haven't registered for password reset." So why isn't it asking them to re-add their authentication methods?

 

I am doing all this in private sessions, no cookies etc.

 

Am I misunderstanding something here?

Edited January 12, 2022 by petben