Home · Lessons

Cloud identity

How to reset an Entra ID password

A user who works in the cloud can't sign in, and they need a new password. The steps are like an on-premises reset, with two extra checks: where the password is managed, and which role you hold.

1. Verify who is asking

A password reset hands someone the keys to an account, so confirm the request really comes from the account owner, or from their manager. Follow your team's identity check. Don't accept a reset request from an email that only claims to be the user.

2. Check where the password is managed

If the account is created in Entra ID, you can reset the password there. If it is synced from on-premises Active Directory, the password normally lives on-premises, and a reset in the cloud only works when password writeback is set up. Check the account first, and reset it in the right place. Otherwise the change may fail, or be overwritten at the next sync.

3. Find the user

Look the user up by their user principal name (UPN), the sign-in name, and note the object ID.

Get-MgUser -Search "UserPrincipalName:[email protected]" -ConsistencyLevel eventual

4. Set a temporary password and force a change

In Microsoft Graph PowerShell the password is part of the user's password profile. Set a temporary value and require the user to choose their own at next sign-in:

Update-MgUser -UserId <object-id> -PasswordProfile @{ Password = '<temporary password>'; ForceChangePasswordNextSignIn = $true }

The lab doesn't offer this command in a free module. Cloud Password Reset, a paid module that is coming soon, practices it in a fake tenant. In a real tenant, run it only if you are allowed to manage that account, and never put a real password in a ticket.

5. Deliver it safely

Give the temporary password to the user through a channel you trust, not in the ticket thread that others can read. Keep it short-lived, and ask them to sign in and change it straight away.

6. Check sign-in and close

Ask the user to sign in. If it still fails, check that the account is enabled, and whether multi-factor authentication or a conditional access policy is blocking them. Then record who asked, how you verified them, and when the reset was done.

Permissions

Resetting a password needs a directory role. Helpdesk Administrator and Password Administrator can reset passwords for most users, but not for administrators, who need a higher role. Check your role before you start.