How to enable self-service password reset in Entra ID

Enabling self-service password reset in Entra ID is a settings page — scope it, pick two verification methods, force registration — plus one extra step for hybrid tenants: password writeback in Entra Connect so the reset reaches on-premises AD. Done properly it removes the single largest category of helpdesk ticket and closes the "call the helpdesk and say you're the CFO" social-engineering path, because a reset now requires methods the user registered, not a sympathetic voice.

The wider design questions — combined registration, which methods to allow, and how SSPR relates to MFA — are in Entra ID self-service password reset. This page is the switch-on.

Prerequisites

Authentication Policy Administrator or Global Administrator.
Entra ID P1 if any user is synced from on-premises AD (for writeback), or for the Windows lock-screen reset.
Combined security information registration enabled (it is the default in tenants created since 2020; older tenants check Entra → User settings → Manage user feature settings). Combined registration means a user registers once for both MFA and SSPR.
For hybrid: Entra Connect Sync or Cloud Sync installed and healthy. Writeback is supported on both, with different setup — Entra Connect vs Cloud Sync covers which you have.

Steps

Progress 0/6

Progress is saved in this browser only.

1. Scope SSPR

Entra admin center → Protection → Password reset → Properties. Choose Selected and a pilot group first, then All once the pilot is clean. None is the state to leave behind.

2. Choose authentication methods

Password reset → Authentication methods. Set Number of methods required to reset: 2. Enable Mobile app notification, Mobile app code, and Mobile phone; enable Email only if users have a non-work address on file that you trust. Avoid Security questions — they are the weakest method and the one attackers research. Note that methods registered for MFA count here under combined registration, so a user with Authenticator already registered is most of the way there.

3. Require registration

Password reset → Registration: Require users to register when signing in: Yes, and Number of days before users are asked to re-confirm: 180. This is the step that makes SSPR actually work on the day someone needs it — an unregistered user still calls the helpdesk.

4. Notifications

Password reset → Notifications: notify users on password resets (Yes), and notify all admins when other admins reset their password (Yes). The second one is a cheap detection for admin-account tampering.

5. Hybrid only: enable password writeback

On the Entra Connect server, run the wizard → Configure → Customize synchronization options → Optional features → Password writeback. Then in Entra, Password reset → On-premises integration: Write back passwords to your on-premises directory: Yes and Allow users to unlock accounts without resetting their password: Yes.

The Entra Connect service account needs Reset password, Change password, Write lockoutTime, and Write pwdLastSet on the user OUs; the wizard sets these if you ran it with Enterprise Admin rights, otherwise grant them manually. Check Password writeback status in Entra Connect Health after the first reset. Cloud Sync writeback is configured in the Cloud Sync agent's provisioning configuration instead.

Intune → Devices → Configuration → New policy → Settings catalog → Authentication → Allow Aad Password Reset: Enabled, assigned to the device group. Hybrid-joined devices additionally need writeback (step 5) and line-of-sight to a domain controller after the reset to update the cached credential.

Verify

With a pilot user, go to https://aka.ms/sspr, complete the two-method verification, and set a new password. For a synced user, confirm the new password works against an on-premises resource within a couple of minutes.
Entra → Protection → Password reset → Audit logs shows the reset; for hybrid, the Entra Connect server's Application event log shows the writeback event (source PasswordResetService).
Usage and insights → Authentication methods activity shows registration climbing toward 100% over the enforcement window.

Roll back

Set Properties back to Selected with an empty group (or None) — existing registrations stay in place, so re-enabling later is instant. Writeback can be disabled in the Entra Connect wizard independently; do that only if writeback itself is failing, otherwise synced users will get a confusing "not enabled" error at the moment they most need it.

Frequently asked questions

Is self-service password reset free in Microsoft 365?

For cloud-only users, yes — SSPR is available in every Microsoft 365 plan. Password writeback for users synced from on-premises Active Directory needs Entra ID P1 (included in Business Premium, E3, E5, F1, F3), and so does the Windows lock-screen reset for hybrid-joined devices.

Why does SSPR say 'your administrator has not enabled this feature' for a synced user?

Almost always because password writeback is not enabled in Entra Connect, or the on-premises service account lacks the Reset Password and Write permissions on the user OU. SSPR for synced users cannot complete without writing the new password back to AD. Check the Entra Connect wizard's Optional features, then the AD permissions.

Can users reset their password from the Windows sign-in screen?

Yes, on Windows 10/11 devices that are Entra joined or hybrid joined, once you enable the 'Reset password' link via an Intune configuration policy (or the AllowPasswordReset registry key). The device must be able to reach the internet from the lock screen; VPN-before-logon setups sometimes break this.