How do we set up self-service password reset in Entra ID?

Key facts

• SSPR now accepts only methods a user or admin has explicitly registered, not profile contact data.
• Password writeback is needed for users whose passwords live in on-premises Active Directory.
• Writeback and SSPR for synced users need Entra ID P1, included in Business Premium and E3.
• Security questions are the weakest method and are best avoided.
• The registration report shows who is enabled, registered and capable of resetting.

Why SSPR is worth setting up

Password resets are one of the most common help desk tickets, and each one is a chance for a social engineering attack if the help desk does not verify the caller well. Self-service password reset lets users prove who they are with a registered method and set a new password themselves, at any hour.

Microsoft has also tightened SSPR so it accepts only authentication methods that were explicitly registered. A phone number or email copied into a user profile from HR or Active Directory no longer counts on its own. Tenants that relied on profile data need to check that users have real registrations.

Check licensing and prerequisites

Admins always have SSPR enabled with a strong two-method policy that you cannot turn off. For regular users, the right licensing depends on where passwords live.

Configure the policy

In the Entra admin center, go to Protection, then Password reset. Scope SSPR to a pilot group first, then to all users. Choose how many methods are required to reset; two is safer than one. Select the methods. Microsoft recommends managing methods through the authentication methods policy, which also governs MFA, so users register once for both.

• Preferred: Microsoft Authenticator notification or code, passkeys where supported in the flow, and hardware OATH tokens.
• Acceptable fallback: mobile phone SMS or call, and an alternate personal email.
• Avoid: security questions, which are easy to guess or research.
• Turn on notifications to users when their password is reset, and to admins when another admin resets theirs.

Turn on password writeback for synced users

If passwords are mastered in on-premises Active Directory, a reset in the cloud must be written back, or the user ends up with two passwords. Enable writeback in Microsoft Entra Connect Sync during configuration, or enable it in Entra Cloud Sync. Then enable the on-premises integration options in the SSPR settings.

The service account used by Entra Connect or the Cloud Sync agent needs reset password and change password permissions on the relevant OUs. Make sure your on-premises password policy, such as minimum age and history, does not block the reset, and test the flow end to end.

Drive registration and test

Registration is where most rollouts fall short. Use combined security info registration at aka.ms/mysecurityinfo, a registration campaign or a Conditional Access policy for registering security information from trusted locations, and communicate why users are being asked.

Check readiness with the Authentication methods activity report and the user registration details view, which show whether each user is SSPR enabled, registered and capable. Test resets with a pilot user on a phone, in a browser and from a Windows sign-in screen, then expand in waves.

How Accred Consulting approaches it

Accred Consulting sets up SSPR as part of identity and MFA projects. Discovery checks licensing, sync method, on-premises password policy and current registration. The proposal sets a clear scope, fixed price and timeline. US-based specialists then configure the authentication methods and SSPR policies, enable password writeback in Entra Connect or Cloud Sync, add the Windows sign-in reset link through Intune, run the registration campaign and test with pilot users before expanding. Handover includes documentation, a help desk process and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions