Self-service password reset (SSPR)
What it is
SSPR lets users reset their own password without calling IT, using registered security methods (authenticator app, phone, email, security questions) to prove who they are.
Why it exists
Password resets are a huge share of help-desk tickets. SSPR reduces that load while keeping security via registration + verification so only the real owner can reset, not an impersonator.
Key ideas
- Requirements — the tenant must have a license (Essentials/premium) and SSPR must be enabled for a chosen scope (selected users or
All). - Registration — users must first register security-info; admins can require registration at sign-in (combined security info).
- Verification — must pass a required number of methods (e.g. 2) before resetting.
- Admin accounts — Azure has one break-glass permanent Global Administrator account whose password cannot be reset via SSPR (a hard rule).
How it fits (diagram)
Diagrams courtesy of Microsoft Learn / Azure docs: entra/identity/authentication/concept-sspr-howitworks
Exam notes
- SSPR scope:
None/Selected/All— and how admin accounts are exempt by default. - Requires registration; push users to register at sign-in.
- Combined registration of MFA + SSPR security info is the modern flow.
Related
entraid · mfa · user-account · conditional-access
📘 Source: Microsoft Learn — Password Reset