Turn on self-service password reset so your staff can reset a forgotten Microsoft 365 password themselves with Forgot my password, using their phone or the Authenticator app, without waiting for an admin.
Before you start
- You need to be a Global Administrator, or have the Authentication Policy Administrator role.
- Admin accounts can already reset their own passwords. This setting is for everyone else.
- It doesn't work on trial subscriptions.
Step-by-step: turn on self-service password reset
- Open Org settings. Sign in to admin.microsoft.com, go to Settings → Org settings and open the Security & privacy tab.
- Go to the Entra password reset page. Select Self-service password reset, then follow the link to turn it on. This opens Password reset in the Microsoft Entra admin centre. You can also go there directly: entra.microsoft.com → Entra ID → Password reset.
- Choose who can use it. On the Properties page, under Self service password reset enabled, choose All. Or choose Selected and pick a group if you'd like to test with a few people first. Select Save.
- Set the verification methods. Open Authentication methods. Set Number of methods required to reset (1 is simplest, 2 is more secure) and tick the methods staff can use, such as mobile app notification, mobile app code, email and mobile phone. Select Save.
- Make sure people register. Open Registration, set Require users to register when signing in to Yes, and leave the reconfirm period at 180 days. Select Save.
- Add a helpdesk link (optional). Under Customization, you can set Customize helpdesk link to Yes and enter an email address or web page staff should use if they get stuck.
What your staff do
Register once: at their next sign-in they'll be asked to confirm a phone number, email address or the Authenticator app. They can also do this at any time at aka.ms/ssprsetup.
Reset a forgotten password:
- On the Microsoft sign-in page, enter their email address and select Forgot my password. They can also go straight to aka.ms/sspr.
- Type the characters shown, then verify using their phone, email or the Authenticator app.
- Choose a new password. They'll get an email confirming the change.
Troubleshooting
Staff are told their account isn't enabled for password reset
The person isn't covered by the setting. Either you chose Selected and they aren't in that group, or their licence doesn't include self-service reset. Reset the password for them as an admin and check the settings above.
Staff are told there isn't enough information to verify them
They haven't registered any verification methods. An admin needs to reset the password, then the user should register at aka.ms/ssprsetup.
The verification code never arrives
Check the phone number registered in their security info is correct and includes the country code (+44 for the UK). Offer the Authenticator app as a second option, as it doesn't rely on text messages.
Last reviewed: October 2026
