Self-service password reset
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 6f963a8 · +7 −5 lines · also on GitHub
⋯ 1 unchanged line
22
title: Self-service password reset deep dive
33
description: How does self-service password reset work
44
ms.topic: concept-article
5
−ms.date: 03/04/2025
6
−ms.reviewer: tilarso
5
+ms.date: 10/05/2026
6
+ms.reviewer: tilarso, marisanchez
77
ms.custom: sfi-ga-nochange, sfi-image-nochange
88
---
99
# How it works: Microsoft Entra self-service password reset
⋯ 29 unchanged lines
3939
* If the authentication methods aren't configured, the user is advised to contact their administrator to reset their password.
4040
* If the policy requires two methods, check that the user has the appropriate data defined for at least two of the authentication methods enabled by the administrator policy.
4141
* If the authentication methods aren't configured, the user is advised to contact their administrator to reset their password.
42
− * If a Microsoft Entra administrator role is assigned to the user, then the strong two-gate password policy is enforced. For more information, see [Administrator reset policy differences](concept-sspr-policy.md#administrator-reset-policy-differences).
42
+ * If an Azure administrator role is assigned to the user, then the strong two-gate password policy is enforced. For more information, see [Administrator reset policy differences](concept-sspr-policy.md#administrator-reset-policy-differences).
4343
* Checks to see if the user's password is managed on-premises, such as if the Microsoft Entra tenant is using federated, pass-through authentication, or password hash synchronization:
4444
* If SSPR writeback is configured and the user's password is managed on-premises, the user is allowed to proceed to authenticate and reset their password.
4545
* If SSPR writeback isn't deployed and the user's password is managed on-premises, the user is asked to contact their administrator to reset their password.
⋯ 41 unchanged lines
8787
8888
## Authentication methods
8989
90
−When a user is enabled for SSPR, they must register at least one authentication method. We highly recommend that you choose two or more authentication methods so that your users have more flexibility in case they're unable to access one method when they need it. For more information, see [What are authentication methods?](overview-authentication.md).
90
+When a user is enabled for SSPR, they must register at least one authentication method. We highly recommend that you choose two or more authentication methods so that your users have more flexibility in case they're unable to access one method when they need it. For more information, see [What are authentication methods?](concept-authentication-methods.md).
9191
9292
The following authentication methods are available for SSPR:
9393
⋯ 21 unchanged lines
115115
116116
#### Mobile app and SSPR
117117
118
−When using a mobile app as a method for password reset, like Microsoft Authenticator, the following considerations apply if an organization hasn't [migrated to the centralized Authentication methods policy](how-to-authentication-methods-manage.md):
118
+For SSPR, Microsoft Authenticator, software OATH tokens, and hardware OATH tokens count as a single authentication method. This behavior applies whether or not an organization has [migrated to the centralized Authentication methods policy](how-to-authentication-methods-manage.md). A user can't use a combination of these methods to satisfy a requirement for two authentication methods.
119
+
120
+If an organization hasn't migrated to the centralized Authentication methods policy, the following considerations also apply when users reset their passwords with a mobile app such as Microsoft Authenticator:
119121
120122
* When administrators require one method be used to reset a password, verification code is the only option available.
121123
* When administrators require two methods be used to reset a password, users are able to use notification **OR** verification code in addition to any other enabled methods.
⋯ 104 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 21:34 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.