What this check looks at
Measures how many enabled member accounts are registered for self-service password reset.
Self-service password reset (SSPR) lets people reset a forgotten password or unlock their account themselves at https://aka.ms/sspr, proving who they are with methods registered in advance, such as Microsoft Authenticator or a mobile number. It is off for ordinary users in a new tenant (administrators always have it). With combined registration, the methods people register for MFA count for password reset too, but only once SSPR is enabled for them and they have registered as many methods as the policy requires.
The check counts enabled member accounts and how many the registration details report shows as registered for SSPR. It passes at 90% or more, warns between 60% and 90%, and fails below 60%, stating how many people would need the service desk to reset a password.
Every unregistered person who forgets a password has to call someone. That costs time, and it is also a weakness: a plausible caller claiming to be a member of staff is the classic way into an account. Attackers ring service desks with details gathered online and ask for a reset; the reset gives them the account with no phishing at all.
Why it matters
Unregistered users raise a service-desk ticket for every forgotten password. Beyond the cost, the reset itself becomes a social-engineering target — an attacker who can talk a helpdesk agent into a reset does not need the password at all.
Service-desk impersonation has been behind several high-profile UK breaches, where attackers phoned the IT helpdesk, posed as an employee and had the password and MFA reset. In a small firm the service desk is often the MSP’s first-line team, who do not know each caller’s voice, which makes the attack easier rather than harder.
There is also a plain running cost. Password resets are among the most common tickets an MSP handles; each one takes engineer time and leaves the person unable to work until it is done, often out of hours or while travelling. When most people can reset their own password, the few remaining reset calls are rare enough to verify properly.
The CIS Microsoft 365 Foundations Benchmark expects self-service password reset to be enabled for all users, and NCSC guidance warns that reset processes are a common target for impersonation and must check identity robustly. For synchronised tenants, password writeback is what lets a reset in the cloud change the on-premises password too.
How to fix it
Where: Entra admin centre → Protection → Password reset
Before you start
- Decide the methods for password reset (Authenticator, phone, email) and how many are required.
- For hybrid tenants, enable password writeback in Entra Connect so resets reach on-premises Active Directory.
Step by step
- Turn on SSPR for everyone. In the Microsoft Entra admin centre, go to Entra ID > Password reset > Properties. Set Self service password reset enabled to All (or Selected, with a group holding every member of staff) and select Save.
- Choose the methods and how many are needed. Under Password reset > Authentication methods, set Number of methods required to reset (two is stronger; one is simpler where most people have only Authenticator) and tick the methods to allow, such as Mobile app notification, Mobile app code, Email and Mobile phone. Leave security questions off: they are guessable. If the authentication methods migration is complete, the same methods must also be enabled under Authentication methods > Policies.
- Require registration at sign-in. Under Password reset > Registration, set Require users to register when signing in to Yes, and the number of days before users are asked to reconfirm their information to 180. People who have not registered enough methods are asked to at their next interactive sign-in.
- Turn on reset notifications. Under Password reset > Notifications, set Notify users on password resets and Notify all admins when other admins reset their password to Yes, so an unexpected reset is noticed by the person it happened to.
- Turn on password writeback in a synchronised tenant. If accounts are synchronised from Active Directory, run the Microsoft Entra Connect wizard on the sync server, choose to customise the synchronisation options and tick Password writeback on the Optional features page (or enable it in Microsoft Entra Cloud Sync). Then, under Password reset > On-premises integration, set Write back passwords to your on-premises directory to Yes. Without it, a reset in the cloud does not change the password used on-premises.
- Tell staff how to use it. Send staff the link https://aka.ms/sspr with a two-line explanation, add it to onboarding notes, and give the service desk a script that sends callers to it before resetting a password by hand.
- Test it and watch registration rise. Reset the password of a non-admin test account at https://aka.ms/sspr and sign in with the new one. Then watch Entra ID > Authentication methods > User registration details, filtered on SSPR registered, as people sign in over the following days. Re-run the assessment once most have signed in; it passes at 90%.
What users will notice
Users are asked to confirm their reset details at sign-in, then can reset their own password at aka.ms/sspr instead of calling the helpdesk.
How to confirm it worked
Use a test account to reset a password at aka.ms/sspr, and check the Authentication methods, Registration details report for coverage.
Frameworks and controls
This check maps to controls in 10 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Identities |
| Secure Score | Enable self-service password reset |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| ISO 27001:2022 | A.5.17 Authentication information |
| CIS M365 | 5.2.4.1 Ensure 'Self service password reset enabled' is set to 'All' |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- How SSPR works (Microsoft Learn)