Self-service password reset (SSPR)
What it is
Self-service password reset (SSPR) lets an enabled user reset or unlock their own Microsoft Entra password without calling IT. Before it can work, the user registers security methods and completes the organisation’s required verification steps.
Why it exists
Password resets are common help-desk work. SSPR gives people a recovery route while requiring more evidence than simply knowing a username. It is about password recovery; it is not the same control as multifactor authentication or Azure RBAC.
Key ideas
- Scope comes first — an administrator enables SSPR for selected users or everyone. A person outside that scope cannot self-reset.
- Registration is the preparation step — users register security information before losing access. The organisation chooses allowed methods and whether one or two methods are required. Requiring two independent methods provides stronger recovery evidence.
- Administrators have extra protection — Microsoft Entra applies a separate, stronger two-gate reset policy to administrator accounts. Do not assume an ordinary user’s recovery configuration applies unchanged to privileged accounts.
- On-premises passwords are a special case — if the password is mastered in on-premises Active Directory, password writeback must be configured for an Entra reset to update that on-premises password. Without it, the user needs an administrator’s help.
- Emergency access is a deliberate design — a break-glass account is an organisation-created, tightly protected recovery account; it is not a built-in account that automatically solves every reset failure.
Northwind example
Luis signs in to Northwind’s ordering application with his Entra account. Before a trip, he registers Microsoft Authenticator and a second approved method. When he forgets his password, SSPR verifies the required methods and lets him choose a new password without waiting for Maya in IT. If Luis’s account instead used an on-premises password and Northwind had not configured password writeback, that same web reset would not update the on-premises directory.
How it fits (diagram)
Diagrams courtesy of Microsoft Learn / Azure docs: entra/identity/authentication/concept-sspr-howitworks
Exam notes
- SSPR must be enabled for the user and requires registered security information.
- SSPR, MFA, and RBAC solve different problems: recovery, sign-in verification, and authorization.
- Verify the separate administrator reset policy and password-writeback requirement when a scenario includes privileged or hybrid identities.
Related
entraid · mfa · user-account · conditional-access
📘 Source: Microsoft Learn — How SSPR works