Self-Service Password Reset (SSPR)

Self-Service Password Reset (SSPR) is a feature of Microsoft Entra ID (formerly Azure Active Directory) that enables users to reset their own passwords when they are locked out or have forgotten them, without requiring administrator intervention. SSPR is part of the Microsoft Entra ID P1 or P2 licensing (or Microsoft 365 Business Premium). It is not available in the Free tier of Entra ID. The feature is designed to reduce help desk call volume—Microsoft reports that up to 50% of help desk calls are password-related—and to improve end-user productivity.

SSPR relies on a multi-step verification process to ensure that only authorized users can reset their passwords. The flow consists of three phases: Registration, Reset, and Notification.

Registration Phase: Before a user can use SSPR, they must register authentication methods. This can be done proactively via the Microsoft Entra ID portal (https://aka.ms/ssprsetup) or enforced by an administrator. The user must register at least one authentication method, but for security, administrators typically require two methods. The available methods include:

Security questions are less secure and are often discouraged; they require at least three questions to be registered, and the user must answer a minimum of three during reset (though the admin can configure the number).

Reset Phase: When a user is locked out or forgets their password, they navigate to the SSPR portal at https://aka.ms/sspr or from the sign-in screen (if integrated). The user enters their user ID and completes a CAPTCHA to prevent automated attacks. Then they are prompted to verify their identity using the registered methods. The administrator configures the number of verification steps required—typically one or two. The user selects an authentication method (e.g., SMS) and receives a code or notification. After successful verification, the user is allowed to set a new password. The new password must meet the organization's password policy (e.g., length, complexity, history).

Notification Phase: After a successful reset, the user receives a confirmation email or notification. Additionally, administrators can configure alerts for password reset attempts, such as sending an email to the user's manager or to a global admin.

To configure SSPR in the Azure portal: 1. Navigate to Microsoft Entra ID > Password reset > Properties. 2. Select "All" or "Selected" to enable SSPR for a group. 3. Under Authentication methods, choose the number of methods required and which methods are allowed. 4. Under Registration, set whether users are prompted to register at sign-in. 5. Under Notifications, configure alerts.

To verify SSPR is working, you can test with a user who has registered methods. Use the "Run a test" option in the SSPR blade (though this may not be available in all tenants).

You can check SSPR settings using the Microsoft Graph PowerShell module:

Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgPolicyAuthenticationMethodPolicy -ExpandProperty "authenticationMethodConfigurations"

To check password reset settings:

Get-MgPolicyAuthenticationMethodPolicy | Select-Object -ExpandProperty AuthenticationMethodConfigurations | Where-Object {$_.Id -like "*password*"}

Note: The exact cmdlets may change; always refer to current documentation.

SSPR is a powerful feature that reduces help desk load and improves user experience. It requires proper licensing, configuration, and user registration. It integrates with on-premises AD via password writeback and with Identity Protection for risk-based access. The SC-900 exam will test your understanding of licensing, authentication methods, and the registration process. Focus on the differences between user and administrator SSPR, and the prerequisites for password writeback.

In a typical enterprise deployment, SSPR is rolled out to reduce help desk costs. For example, Contoso Corporation with 10,000 employees deploys SSPR for all users with two-factor authentication: mobile app notification and a backup email. They require users to register during their next sign-in. The help desk sees a 40% reduction in password-related calls within three months. However, they faced initial resistance from users who did not want to install the Microsoft Authenticator app. To mitigate this, they allowed SMS as an alternative method for the first 90 days, then phased it out. They also integrated SSPR with on-premises Active Directory via password writeback, which required upgrading to Microsoft Entra Connect and ensuring the service account had proper permissions. A common issue they encountered was that users who were not licensed for Entra ID P1 could not use SSPR, causing confusion. They resolved this by assigning P1 licenses to all users via group-based licensing. Another scenario is a university with 50,000 students. They enabled SSPR for students but used security questions (three questions) as the primary method due to the lack of mobile devices. However, they found that students often forgot their answers, leading to lockouts. They eventually switched to email verification using the university-issued email address. In production, performance is rarely an issue, but lockouts can occur if users attempt resets too frequently. The default lockout of 5 attempts per hour is usually sufficient. Misconfigurations often include forgetting to enable password writeback for hybrid environments, which causes the new password to be set only in the cloud, leaving on-premises AD out of sync. Also, administrators sometimes forget to register their own methods, then are unable to use SSPR themselves. Best practice is to require all administrators to register methods during onboarding.