Skip to content
← Back to the guide

How to enable self-service password reset in Entra ID

8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 8

How to enable self-service password reset in Entra ID

How to enable self-service password reset in Entra ID: scope, methods, registration enforcement, password writeback for hybrid, and Windows lock-screen reset.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-enable-self-service-password-reset-in-entra-id

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 8
01

Is self-service password reset free in Microsoft 365?

For cloud-only users, yes — SSPR is available in every Microsoft 365 plan. Password writeback for users synced from on-premises Active Directory needs Entra ID P1 (included in Business Premium, E3, E5, F1, F3), and so d…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-enable-self-service-password-reset-in-entra-id

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 8
02

Why does SSPR say 'your administrator has not enabled this feature' for a synced user?

Almost always because password writeback is not enabled in Entra Connect, or the on-premises service account lacks the Reset Password and Write permissions on the user OU. SSPR for synced users cannot complete without w…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-enable-self-service-password-reset-in-entra-id

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 8
03

Can users reset their password from the Windows sign-in screen?

Yes, on Windows 10/11 devices that are Entra joined or hybrid joined, once you enable the 'Reset password' link via an Intune configuration policy (or the AllowPasswordReset registry key). The device must be able to rea…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-enable-self-service-password-reset-in-entra-id

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 8
04

Step 1: Scope SSPR

Entra admin center → Protection → Password reset → Properties. Choose Selected and a pilot group first, then All once the pilot is clean. None is the state to leave behind.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-enable-self-service-password-reset-in-entra-id

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 8
05

Step 2: Choose authentication methods

Password reset → Authentication methods. Set Number of methods required to reset: 2. Enable Mobile app notification, Mobile app code, and Mobile phone; enable Email only if users have a non-work address on file that you…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-enable-self-service-password-reset-in-entra-id

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 8
06

Step 3: Require registration

Password reset → Registration: Require users to register when signing in: Yes, and Number of days before users are asked to re-confirm: 180. This is the step that makes SSPR actually work on the day someone needs it — a…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-enable-self-service-password-reset-in-entra-id

Slide 7Download PNG
M
solvingmicrosoft365.com
8 / 8
07

Step 4: Notifications

Password reset → Notifications: notify users on password resets (Yes), and notify all admins when other admins reset their password (Yes). The second one is a cheap detection for admin-account tampering.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-enable-self-service-password-reset-in-entra-id

Slide 8Download PNG

Auto-generated from How to enable self-service password reset in Entra ID. This page is not indexed and isn't part of the guide itself.