Self-service password reset

[added: Allow password change after secure sign-in helps your organization move users to passwordless authentication while supporting legacy applications that still require a password. Users can rely on passwordless authentication for everyday sign-ins without needing to remember their current password to change it.]

Before: No saved wording on this side.

After: Allow password change after secure sign-in helps your organization move users to passwordless authentication while supporting legacy applications that still require a password. Users can rely on passwordless authentication for everyday sign-ins without needing to remember their current password to change it.

[removed: Passwordless] [added: Instead of completing a traditional SSPR flow, passwordless] users can change their cloud password [added: directly] from Security [removed: info without knowing or entering their current password. Before they create] [added: info. This provides] a [removed: new password, they] [added: more seamless password change experience: users] sign in with one of the following passwordless [removed: methods:] [added: methods, then create a new password without entering their current one:]

Before: Passwordless users can change their cloud password from Security info without knowing or entering their current password. Before they create a new password, they sign in with one of the following passwordless methods:

After: Instead of completing a traditional SSPR flow, passwordless users can change their cloud password directly from Security info. This provides a more seamless password change experience: users sign in with one of the following passwordless methods, then create a new password without entering their current one:

[added: In this example, a user who signs in with a phishing-resistant credential can change their password without entering the current one. The user still has a working phishing-resistant method. This isn't a self-service password reset (SSPR) flow or an account recovery flow.]

Before: No saved wording on this side.

After: In this example, a user who signs in with a phishing-resistant credential can change their password without entering the current one. The user still has a working phishing-resistant method. This isn't a self-service password reset (SSPR) flow or an account recovery flow.

[added: Contoso enables Allow password change after secure sign-in. and requires the built-in Phishing-resistant MFA authentication strength through Conditional Access. A user has a passkey and a password.]

Before: No saved wording on this side.

After: Contoso enables Allow password change after secure sign-in. and requires the built-in Phishing-resistant MFA authentication strength through Conditional Access. A user has a passkey and a password.

[added: The user signs in with the passkey, which satisfies the Conditional Access policy.]

Before: No saved wording on this side.

After: The user signs in with the passkey, which satisfies the Conditional Access policy.

[added: The user goes to Security info in My Sign-Ins and selects Change next to Password.]

Before: No saved wording on this side.

After: The user goes to Security info in My Sign-Ins and selects Change next to Password.

[added: Because the user authenticated with a phishing-resistant credential, they aren't prompted for the current password. They set a new password and continue working.]

Before: No saved wording on this side.

After: Because the user authenticated with a phishing-resistant credential, they aren't prompted for the current password. They set a new password and continue working.

[added: No administrator action, SSPR, or account recovery is required. The user continues to satisfy the phishing-resistant authentication requirement.]

Before: No saved wording on this side.

After: No administrator action, SSPR, or account recovery is required. The user continues to satisfy the phishing-resistant authentication requirement.

[added: This is no longer a password change scenario. The user has lost the only credential that can satisfy Contoso's Conditional Access policy and must go through account recovery to re-establish their identity and register a new passkey. The password alone can't satisfy this policy.]

Before: No saved wording on this side.

After: This is no longer a password change scenario. The user has lost the only credential that can satisfy Contoso's Conditional Access policy and must go through account recovery to re-establish their identity and register a new passkey. The password alone can't satisfy this policy.

[added: If your organization has configured account recovery, the user starts recovery from the sign-in page, completes identity verification, receives a Temporary Access Pass (TAP), and registers a new passkey.]

Before: No saved wording on this side.

After: If your organization has configured account recovery, the user starts recovery from the sign-in page, completes identity verification, receives a Temporary Access Pass (TAP), and registers a new passkey.

[added: If account recovery isn't configured, an administrator can reset the user's password and issue a TAP so the user can register a new passkey.]

Before: No saved wording on this side.

After: If account recovery isn't configured, an administrator can reset the user's password and issue a TAP so the user can register a new passkey.

[added: In both paths, the TAP is a temporary bootstrap credential. It doesn't satisfy the phishing-resistant authentication strength, so plan your Conditional Access and recovery design to allow the user to complete passkey registration. See Account recovery overview for the recommended recovery architecture.]

Before: No saved wording on this side.

After: In both paths, the TAP is a temporary bootstrap credential. It doesn't satisfy the phishing-resistant authentication strength, so plan your Conditional Access and recovery design to allow the user to complete passkey registration. See Account recovery overview for the recommended recovery architecture.

[added: Situation What the user still has Path Forgot password Passkey Password change (this feature) Lost passkey Password only Account recovery]

Before: No saved wording on this side.

After: Situation What the user still has Path Forgot password Passkey Password change (this feature) Lost passkey Password only Account recovery

[removed: Important This feature rolls out across all clouds starting in late October 2026, with rollout expected to complete by the end of November 2026. If you don't see the setting in your tenant, the rollout might not have reached your tenant yet.]

Before: Important This feature rolls out across all clouds starting in late October 2026, with rollout expected to complete by the end of November 2026. If you don't see the setting in your tenant, the rollout might not have reached your tenant yet.

After: No saved wording on this side.

[removed: This experience helps users who primarily sign in without a password but still need a password for legacy applications.]

Before: This experience helps users who primarily sign in without a password but still need a password for legacy applications.

After: No saved wording on this side.