Self-service password reset

[added: Self-service password reset]

[added: Allow password change after secure sign-in.]

[added: Important This feature rolls out across all clouds starting in late October 2026, with rollout expected to complete by the end of November 2026. If you don't see the setting in your tenant, the rollout might not have reached your tenant yet.]

[added: Passwordless users can change their cloud password from Security info without knowing or entering their current password. Before they create a new password, they sign in with one of the following passwordless methods:]

[added: Microsoft Entra certificate-based authentication (CBA).]

[added: A passkey (FIDO2).]

[added: A Microsoft Authenticator passwordless phone sign-in notification.]

[added: This experience helps users who primarily sign in without a password but still need a password for legacy applications.]

[added: This password change experience is separate from SSPR. Users don't need to be registered for SSPR, and the number of authentication methods required by the SSPR policy doesn't apply.]

[added: To use this feature, users need a Microsoft Entra ID P1 or P2 license.]

[added: By default, passwordless users can't change their password without entering their current password. To enable the experience, you need at least the Authentication Policy Administrator role.]

[added: Sign in to the Microsoft Entra admin center.]

[added: Browse to Entra ID > Authentication methods > Policies.]

[added: Select Password, and then select Configure.]

[added: Enable Allow password change after secure sign-in.]

[added: Select Save.]

[added: The setting applies to all users in the tenant. You can't target or exclude individual users or groups.]

[added: To change their password, an eligible user completes these steps:]

[added: Go to Security info.]

[added: Sign in with Microsoft Entra CBA, a passkey (FIDO2), or a Microsoft Authenticator passwordless phone sign-in notification.]