Implement Self-Service Password Reset (SSPR) in Azure AD

You can enable SSPR for all users, a group of users, or specific users.

1. Sign in to the Azure portal as a Global Administrator.
2. Navigate to Azure Active Directory.
3. In the left navigation pane, select Password reset.
4. Under the Properties tab, click On for "Enable self-service password reset".
5. Under "Which users can reset their password?", select the desired scope:
   • None (This is the default and means SSPR is disabled).
   • All (Enables SSPR for all users in your directory).
   • Selected (Allows you to choose specific Azure AD groups to enable SSPR for).
6. If you select "Selected", click Add group and choose the groups you want to include.
7. Click Save.

Define which methods users can use to verify their identity during password reset.

1. In the Azure AD Password reset blade, go to the Authentication methods tab.
2. Under "Number of methods required to reset", choose how many methods a user needs to register (e.g., 1 or 2).
3. Under "Available authentication methods", select the methods you want to allow. Common options include:
   • Mobile app notification
   • Mobile app code
   • Email
   • Mobile phone
   • Office phone
   • Security questions
4. For methods like "Mobile phone" and "Email", you can choose whether they are available to all users or only specific groups.
5. Click Save.

Ensure users register the required authentication methods.

1. In the Azure AD Password reset blade, go to the Registration tab.
2. For "Require users to register when they log in", choose Yes to prompt users to register their authentication methods upon their next sign-in.
3. You can set a duration in days for how long users have to register before being forced to do so.
4. Click Save.

Brand your SSPR portal with your company's logo and contact information.

1. In the Azure AD Password reset blade, go to the Customization tab.
2. Under "Link to access panel", configure the URL that users will be directed to for password reset.
3. Under "Helpdesk link", provide a URL or email address for users to contact if they need further assistance.
4. Upload your company logo.
5. Click Save.

Users need to register their authentication methods. They can do this by visiting a dedicated registration portal or when prompted after login.

• Users can register by navigating to https://aka.ms/ssprsetup.
• When a user needs to reset their password, they can click the "Can't access your account?" link on the Azure AD sign-in page and follow the prompts.