Self-service password reset
Any two versions this installation kept of the page, compared the same way as each observed change. All guidance changes · Latest observation
Entra · Official Microsoft guidance24 Oct 00:41 UTC → 30 Oct 01:16 UTC
What changed
May need admin actionCheck whether new requirements apply to your setup; check whether a default changed for your tenant or devices; check the roles and permissions you grant.
Changed article references · 5 added · 0 removed
Literal authored targets and labels, including relative addresses. Image bytes are not captured or compared.
- Added link: Allow password change after secure sign-in.
#tabpanel_1_secure-sign-in - Added link: Self-service password reset
#tabpanel_1_sspr - Added link: Authentication Policy Administrator
../role-based-access-control/permissions-reference#authentication-policy-administrator - Added link: Security info
https://aka.ms/mysecurityinfo - Added link: Microsoft Entra admin center
https://entra.microsoft.com
[added: Self-service password reset]
[added: Allow password change after secure sign-in.]
[added: Important This feature rolls out across all clouds starting in late October 2026, with rollout expected to complete by the end of November 2026. If you don't see the setting in your tenant, the rollout might not have reached your tenant yet.]
[added: Passwordless users can change their cloud password from Security info without knowing or entering their current password. Before they create a new password, they sign in with one of the following passwordless methods:]
[added: Microsoft Entra certificate-based authentication (CBA).]
[added: A passkey (FIDO2).]
[added: A Microsoft Authenticator passwordless phone sign-in notification.]
[added: This experience helps users who primarily sign in without a password but still need a password for legacy applications.]
[added: This password change experience is separate from SSPR. Users don't need to be registered for SSPR, and the number of authentication methods required by the SSPR policy doesn't apply.]
[added: To use this feature, users need a Microsoft Entra ID P1 or P2 license.]
[added: By default, passwordless users can't change their password without entering their current password. To enable the experience, you need at least the Authentication Policy Administrator role.]
[added: Sign in to the Microsoft Entra admin center.]
[added: Browse to Entra ID > Authentication methods > Policies.]
[added: Select Password, and then select Configure.]
[added: Enable Allow password change after secure sign-in.]
[added: Select Save.]
[added: The setting applies to all users in the tenant. You can't target or exclude individual users or groups.]
[added: To change their password, an eligible user completes these steps:]
[added: Go to Security info.]
[added: Sign in with Microsoft Entra CBA, a passkey (FIDO2), or a Microsoft Authenticator passwordless phone sign-in notification.]
Source: Microsoft source · © Microsoft · MIT.
Other changed sections
Read the current Microsoft source
Compares the selected versions; edits made and undone between them do not appear.