Azure Active Directory (Azure AD) self service password reset (SSPR) gives users the ability to change or reset their password, with no administrator or help desk involvement. If a user’s account is locked or they forget their password, they can follow prompts to unblock themselves and get back to work. This ability reduces help desk calls and loss of productivity when a user can’t sign in to their device or an application.
With Azure Active Directory (Azure AD) self service password reset (SSPR), users can update their password or unlock their account using a web browser. Please note that in a hybrid environment where Azure AD Connect is used to sync accounts from Active Directory to Azure AD, this scenario can cause passwords to be different between the two directories if password write back is not enabled. Password write back can be used to synchronise password changes in Azure AD back to your on premises Active Directory environment. Azure AD Connect provides a secure mechanism to send these password changes back to an existing on premises directory from Azure AD.
The password reset feature includes a set of capabilities that allow users to manage any password from any device, at any time, from any location, while remaining in compliance with company security policies.
In this blog post, I will go through the process of enabling password write back within Azure AD Connect, enabling self service password reset for a group of Azure AD users, go through the authentication methods and registration options.
- Login to your Azure AD Connect Server if you’re syncing your Active Directory accounts to Azure AD
2. Enabled Password Write Back in Azure AD Connect and save settings
3. Let’s confirm Azure AD has picked up the change
4. Login to the Azure Portal portal.azure.com
5. Click Azure Active Directory or locate via the search box
6. Click Password Reset located in the left menu
7. Click On-premises integration
8. Done, see screen shot below.
Notice the additional option to allow users to unlock accounts without resetting their password. This feature designates whether or not users who visit the password reset portal should be given the option to unlock their on premises Active Directory accounts without resetting their password. By default, Azure AD will always unlock accounts when performing a password reset, this setting allows you to separate those two operations. If set to yes, then users will be given the option to reset their password and unlock the account, or to unlock without resetting the password. If set to no, then users will only be able to perform a combined password reset and account unlock operation.
I have left the default settings
9. Now, let’s enable self password reset, click Azure Active Directory and click password reset
10. The password reset feature is disabled by default
11. I will be clicking selected and applying the policy to a security group named CloudBuildPR. Click select
12. Click Save
13. While in the password reset section, you’ll notice Authentication methods in the left menu. Here you can setup the number of authentication methods, including prompting your users to setup security questions as additional authentication options. You can specify your own custom questions that will be visible to the user or select the built in ones provided by Microsoft.
For the purpose of this demo, I will leave the default options enabled. Note that all features may not be available depending on your license type.
14. Moving down the menu, you’ll find Registration including the option on how often you require your users to re-confirm their authentication information they originally submitted. By default it’s 180 days and users are required to register when signing in.
15. The next option down is notifications. The default settings are shown below and are self explanatory.
16. Finally, it’s customization. You could add a link to your online helpdesk portal or an email address to allow users to contact IT in the event they require further assistance. I have already covered on-premise integration earlier so won’t cover that one again
17. Ok, so i’m all set. I have enabled password write back within Azure AD Connect and enabled Password Reset. I have confirmed the configuration has been picked up within Azure AD.
18. That’s it. Visit passwordreset.microsoftonline.com to test
If you’re using a free trial account, you’ll receive the below message. At the time of writing this blog post, the password reset option does not function with trial accounts.
You can’t reset your own password because you haven’t registered for password reset.
You haven’t registered the necessary security information to perform password reset
Further Azure Password Reset FAQ’s can be located at the following Microsoft link Azure Self Password Reset FAQ