Skip to main content
Self-Service Password Reset (SSPR) lets users recover and reset forgotten passwords without contacting IT. It delivers a secure, scalable “Forgot password” experience—similar to consumer banking flows—by letting users verify their identity with one or more authentication methods (mobile app, phone, email, security questions, etc.) and immediately set a new password. Important licensing note:
A presentation slide titled "Self-Service Password Reset (SSPR)" with icons and short notes about features like resetting passwords without IT, multiple authentication methods, a Premium P2 requirement, and targeting options. On the right is a Microsoft Azure portal screenshot showing the Password reset → Authentication methods settings and available verification options.

​
Key capabilities

  • Enable SSPR for all users or target selected groups.
  • Choose which verification methods are available (authenticator app, phone, email, security questions).
  • Require one or more authentication methods for a successful reset.
  • Enforce user registration and set reconfirmation frequency to keep recovery information current.
Security questions are deprecated for newly created tenants and are not recommended as a primary recovery mechanism. Prefer stronger methods such as an authenticator app, SMS/voice to a verified phone number, or email where appropriate.
Verification methods (examples)

​
Getting started (high level)

  1. Enable SSPR for All users or Selected groups.
  2. Configure the required number of authentication methods and select allowed methods.
  3. Enforce registration so users supply verification methods at sign-in.

​
Administrators and SSPR

Administrators can be included or excluded from SSPR policies depending on your organization’s security posture. Carefully test SSPR settings for privileged accounts before broad enforcement.
Exclude break-glass or highly privileged accounts, or provision dedicated recovery accounts, to avoid administrative lockout. Test recovery procedures for privileged accounts before enforcing SSPR at scale.

​
Configuring SSPR in the Azure portal

  1. Open Microsoft Entra ID (Azure Active Directory) and navigate to Password reset.
  2. Under Properties, choose either All or Selected and target the appropriate groups (for example, a practice group named “Avengers”). Click Save to create the policy.
  3. Under Authentication methods, set the number of methods required for a reset and select which methods are permitted. Requiring a single method is common for usability; requiring multiple methods increases security.
The example below shows a configuration where 1 method is required and “Mobile app code” (Authenticator app TOTP) is allowed.
A Microsoft Azure portal screenshot showing the "Password reset | Authentication methods" settings, with the number of methods required set to 1 and "Mobile app code" checked. The left navigation menu and a top-right notification saying "Password reset policy saved" are also visible.

​
Registration settings

Require users to register for SSPR the next time they sign in by enabling the registration enforcement toggle. Also configure how frequently users must re-confirm their authentication information (for example, 180 days). After that period users will be prompted to verify and refresh their methods (Authenticator app, phone, email) to keep recovery options up to date.
A screenshot of the Microsoft Azure portal showing the "Password reset | Registration" settings, including a toggle for requiring users to register when signing in and a field set to 180 days for re-confirming authentication information. The left pane shows related options like Properties, Authentication methods, Notifications, and Administrator Policy.

​
User experience: registering SSPR methods

When registration is enforced, users who haven’t set up recovery methods will be prompted at sign-in. A typical flow:
  • User scans a QR code to register Microsoft Authenticator (or enters a TOTP key).
  • User verifies phone number or recovery email as required.
  • After completing steps, SSPR is configured for that account.
Users can update or remove methods later at the SSPR setup page: https://aka.ms/ssprsetup — this redirects to the Security info / My Sign‑ins page where methods can be managed (subject to admin policy).
A screenshot of the Microsoft "My Sign‑Ins" Security info page showing default sign‑in methods. It lists Password and an Authenticator app (TOTP) with options to change or delete, plus a sidebar menu.

​
Resetting a forgotten password

Users can initiate a self-service reset in two main ways:
  • Direct SSPR URL: https://aka.ms/sspr — enter your username, complete the CAPTCHA, and follow the verification prompts (for example, enter the code from the Authenticator app) to set a new password.
  • From the sign-in page: click “Can’t access your account?” → choose “Work or school account” to reach the same flow (landing at passwordreset.microsoftonline.com).
The screen below shows the account recovery page where the user supplies username and CAPTCHA.
A Microsoft account recovery/password reset webpage asking for your email or username and to enter the characters from a CAPTCHA. The screen shows a distorted captcha image, input fields, and "Next" and "Cancel" buttons.
After the user verifies with the chosen method (for example, entering the Authenticator TOTP), they are prompted to create a new password. Completion of that step finalizes the self-service reset.

​
Recap

  • SSPR reduces helpdesk load and improves user productivity by enabling secure password recovery without IT intervention.
  • Configure SSPR in Microsoft Entra ID → Password reset: select target users/groups, authentication methods, and registration settings.
  • For on-premises password writeback, configure Azure AD Connect and ensure you have the required Azure AD Premium license (P1 or P2): https://learn.microsoft.com/azure/active-directory/hybrid/whatis-azure-ad-connect
  • Users can register at https://aka.ms/ssprsetup and start a reset at https://aka.ms/sspr.

​
Next topic

This article covered SSPR in a single-tenant (one Entra ID) scenario. If you operate in or plan for multi-tenant environments, review multi-tenant considerations and identity planning for SSPR to ensure consistent behavior and compliance across tenants.

Watch Video