How to Enable Self-Service Password Reset in Microsoft Entra

Password resets are one of the most common help desk tickets. Microsoft Entra self-service password reset (SSPR) lets users unlock their own accounts and choose a new password after proving who they are. This guide follows Microsoft’s tutorial: pilot with one group, configure how users verify themselves, and test the experience before rolling it out wider.

Before you start

• Licensing: the tenant needs at least a Microsoft Entra ID P1 license for password reset.
• Role: sign in as at least an Authentication Policy Administrator.
• A test user: a non-administrator account whose password you know. Administrators have SSPR enabled by default and must use two methods, so they make poor test subjects.
• A test group: a group containing that user, for example SSPR-Test-Group.

Step 1: Enable SSPR for a pilot group

SSPR can be set to None, Selected, or All. Start with Selected so you can test before everyone is affected.

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Password reset.
3. On Properties, set Self service password reset enabled to Selected.
4. Select No groups selected, pick your test group, and choose Select.
5. Select Save.

Only one group can be selected in the admin center, but nested groups are supported. To cover the whole tenant later, choose All in the same setting.

Step 2: Choose authentication methods

1. Open Authentication methods.
2. Set Number of methods required to reset to 2. Requiring more methods improves security.
3. Under Methods available to users, enable mobile app notification, mobile app code, email, and mobile phone.
4. Select Save.

Step 3: Require registration

1. Open Registration.
2. Set Require users to register when signing in to Yes.
3. Set the number of days before users must reconfirm their information to 180.
4. Select Save.

Keep contact details fresh: outdated phone numbers and email addresses are a common reason a reset fails. Users are prompted once per interactive session when the conditions are met.

Step 4: Turn on notifications

1. Open Notifications.
2. Set Notify users on password resets? to Yes.
3. Set Notify all admins when other admins reset their password? to Yes.
4. Select Save.

Step 5 (optional): Add a helpdesk link

On Customization, set Customize helpdesk link to Yes and enter a helpdesk email address or URL, then select Save. Users who get stuck will see where to go.

Step 6: Test as an end user

1. Open a new InPrivate or incognito window and go to https://aka.ms/ssprsetup.
2. Sign in as the test user and register authentication contact information, then select Looks good.
3. Open another InPrivate or incognito window and go to https://aka.ms/sspr.
4. Enter the test user’s account name and the CAPTCHA characters, then select Next.
5. Complete the verification steps and set a new password. The user should receive an email confirming the reset.

Roll out and clean up

• Widen the scope: once the pilot works, switch Self service password reset enabled to All or point it at your production group, and tell users where to register.
• Disable it: to switch SSPR off, set the option to None and save. Skip this if you plan to configure password writeback for hybrid environments next.

Good to know

• Legacy policies: Microsoft states that since September 30, 2025, authentication methods can no longer be managed in the legacy MFA and SSPR policies. If you still use them, migrate to the Authentication methods policy.
• Plan the rollout: run a short communication ahead of the change so users register before they need to reset.

Sources

• Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset – Microsoft Learn