Password Resets: Set Up Self-Service in Entra ID and On-Prem AD

Password resets are the most common ticket on most helpdesks. Each one is small, but they add up, and every reset that goes through a person is a reset the user could have done alone in two minutes.

This post covers how to handle a reset properly when it lands on the desk, and how to set up self-service so most of them never do. It covers Microsoft Entra ID self-service password reset (SSPR) and on-prem Active Directory, including the hybrid case where both are in play.

Handle the reset ticket the right way

Before touching the account, confirm who you are talking to. A reset is an identity decision. Ask for something the caller should know that is not in their email signature, or call them back on the number in the HR system. Attackers phone helpdesks pretending to be locked-out staff, and a friendly reset is exactly what they are after.

Once verified, reset in Active Directory Users and Computers: find the user, right-click, Reset Password. Tick User must change password at next logon unless the user is on a laptop that cannot reach a domain controller before login, because that combination locks them out of the machine. Unlock the account in the same dialog if it shows as locked.

Set-ADAccountPassword -Identity jsmith -Reset -NewPassword (Read-Host -AsSecureString)
Set-ADUser jsmith -ChangePasswordAtLogon $true
Unlock-ADAccount jsmith

Turn on self-service password reset in Entra ID

Entra ID SSPR lets users reset their own password from the Windows sign-in screen or from aka.ms/sspr after proving who they are with a second method. Licensing matters: cloud-only reset is included with most Microsoft 365 business plans, and writeback to on-prem AD needs Entra ID P1 or P2, which is also part of Microsoft 365 Business Premium, E3 and E5.

1. In the Entra admin center go to Protection > Password reset > Properties and set Self service password reset enabled to Selected. Start with a pilot group, then move to All.
2. Under Authentication methods pick how many methods are required (two is the safer choice) and which ones count: Authenticator app notification, Authenticator code, email, mobile phone, security questions.
3. Under Registration set Require users to register when signing in to Yes. Users get prompted at their next interactive login and it takes about a minute.
4. Under Notifications turn on Notify users on password resets and Notify all admins when other admins reset their password.

Hybrid: password writeback to on-prem AD

If your accounts are synced from on-prem AD with Entra Connect, a cloud reset alone is not enough. The user's laptop and file shares still check the domain controller. Password writeback closes that gap: the new password set in the cloud is written back to AD within seconds.

1. Open Entra Connect on the sync server, choose Configure > Customize synchronization options, and tick Password writeback under Optional features.
2. In the Entra admin center under Password reset > On-premises integration, confirm Write back passwords to your on-premises directory shows On, and enable Allow users to unlock accounts without resetting their password.
3. Give the Entra Connect AD account the permissions it needs on the user OUs: Reset password, Change password, Write lockoutTime and Write pwdLastSet. Missing permissions show up as errors in the Application log on the sync server.
4. Test with a pilot user: reset from aka.ms/sspr, then sign in to a domain-joined PC on the office network with the new password.

Reset from the Windows lock screen

The best self-service is at the point of failure. On Windows 10 and 11 devices that are Entra joined or hybrid joined, a Reset password link can appear on the sign-in screen. It is controlled by the Intune device restriction setting Password Recovery (the AllowPasswordReset CSP) or the matching Group Policy on older builds.

For hybrid devices the machine needs a line of sight to a domain controller right after the reset, so it works in the office or over an always-on VPN, not from a hotel room. Tell users that up front so they do not assume the feature is broken.

Common failures and where to look

• "Your administrator has not enabled this feature": the user is not in the SSPR-enabled group, or the group is nested. Nested groups are not supported for the SSPR scope group.
• Reset succeeds in the cloud but the old password still works on the laptop: writeback is off, the ADSync service is stopped, or the connector account lacks permissions. Look in the Application log on the sync server, source PasswordResetService.
• The registration prompt never appears: the user signs in through an older app that does not support the interrupt, or the registration setting is scoped to a different group.
• New password rejected by the cloud reset: the on-prem password policy (length, history, complexity) is enforced at writeback and the error is generic. Check the Default Domain Policy or any fine-grained password policy.
• Account locks again minutes after the reset: a saved credential somewhere is still trying the old password. See our post on tracking down lockout sources.

Frequently asked questions

Takeaway

Every reset that goes through self-service is one fewer interruption for the desk and one fewer opening for a social engineer. Set up SSPR with writeback, force registration, and keep a verified manual process for the exceptions. If your hybrid setup is in place but writeback never worked, RackLedge can check the sync server and permissions with you.