This week is about something similar as last week. This week is all about the password reset option on the login screen. In other words, the Reset password option. Starting with Windows 10, version 1709, it’s possible to enable the Reset password option from the login screen for Azure AD joined devices. I know that a lot has been written already about this subject, but I have the feeling that this subject needs a place on my blog. My style and more details. In this post I’ll provide a short introduction about Azure AD self-service password reset (SSPR), followed by walking through the required configurations for SSPR and the Reset password option. I’ll end this post by looking at the end-user experience.
Introduction
Now let’s start this post with an introduction about Azure AD SSPR. With SSPR users can reset their passwords on their own when and where they need to. At the same time, administrators can control how a user’s password gets reset. That means that the user no longer needs to call a help desk just to reset their password. SSPR includes (the focus of this post is number 2):
- Self-service password change: The user knows their password but wants to change it to something new;
- Self-service password reset: The user is unable to sign in and wants to reset their password by using one or more of the following validated authentication methods:
- Send a text message to a validated mobile phone;
- Make a phone call to a validated mobile or office phone;
- Send an email to a validated secondary email account;
- Answer their security questions.
- Self-service account unlock: The user is unable to sign in with their password and has been locked out. The user wants to unlock their account without administrator intervention by using their authentication methods.
Configuration
Let’s continue by having a look at the required configuration, to enable the Reset password option from the login screen. As the configuration of the actual settings requires SSPR to be enabled, I divided the configuration into two steps. The first step is to enable SSPR and the second step is to configure the Reset password option.
Step 1a: Enable SSPR
The first step is to enable SSPR, as it’s the starting point for enabling the Reset password option from the login screen. Without SSPR enabled, and still configuring the Reset password option, the user will receive a message that SSPR is not enabled for the user and that the user should contact the administrator. The following seven steps walk through the relatively simple configuration to enable SSPR.
1 | Open the Azure portal and navigate to Azure Active Directory > Password reset; |
2 |
|
3 |
Note: Make sure that you have at least as many methods available to users as you have required to reset. |
4 |
|
5 |
|
6 |
|
7 |
Note: This is required when using an on-premises directory and also requires the configuration of step 1b. |
Step 1b: (Optional) Configure password writeback
Another part of the first step is the optional configuration of password writeback. This should be configured to write the passwords from Azure AD back to the on-premises directory. To achieve this, use the following seven steps to reconfigure Azure AD Connect.
Step 2: Enable Reset password option
The second step is to configure the required setting to enable the Reset password option from the login screen. In other words, the second step is to configure a device configuration profile with at least a custom OMA-URI setting. The required setting is part of the Authentication node of the Policy CSP. It’s the AllowAadPasswordReset policy. That policy allows administrators to enable the self-service password reset feature on the windows logon screen. An integer value of 0 means not enabled and an integer value of 1 means enabled.
The following three steps walk through the creation of a new device configuration profile, including the required OMA-URI setting. After that simply assign the created profile to a user group.
1 | Open the Azure portal and navigate to Intune > Device configuration > Profiles; |
2 | On the Devices configuration – Profiles blade, click Create profile to open the Create profile blade; |
3a |
On the Create profile blade, provide the following information and click Create;
|
3b |
|
Note: For testing purposes it’s also possible to configure the Reset password option by using the HKLM\SOFTWARE\Policies\Microsoft\AzureADAccount registry key with the value, type and data of AllowPasswordReset, REG_DWORD and 1.
End-user experience
Now let’s end this post by walking through the end-user experience. On the login screen a new option is available when selecting password as the sign-in option, the Reset password option.
When the user selects Reset password, the user will be redirected to the Azure AD self-service password reset service.
The User ID is already prepopulated and when the user clicks on Next, the user should choose a verification method. In my case a text to my mobile phone.
When the user provides the correct mobile phone number and clicks on Next, the user must provide the actual verification code of the text message.
When the user provides the correct verification code and clicks on Next, the user must provide a new password.
When the user provides a new password and clicks Next, the user will be provided with the message that the password has been reset. When the user than clicks on Finish, the user will be redirected to the login screen.
More information
For more information about SSPR, Windows 10 and the Reset password option, please refer to the following articles:
- How to successfully roll out self-service password reset: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-best-practices
- Azure AD password reset from the login screen: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-login
- Policy CSP – Authentication: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-authentication
Hi! Is there a way to redirect to a custom Password Reset Portal? My organization does not use AAD for password reset, but we have Azure AD Premium. We want to redirect to a custom URL though… thanks! JJ
Dont forget if you used Custom AD Connect installation with a service account, you need to set permissions for this account. Change Password,Reset Password,Write Lockout,Write PwdLastSet
Hi Peter
Nice blog post, as usual from you!
We have some issue regarding this function. Our customer has the following update scenario from 1511 to 1607 and further to 1703. This ‘reset password’ option is not even appear on the login screen!
MSFT support answer: “We have been continuously working and researching with our TA’s on this issue but as we currently are not able to replicate the issue at our end we are unable to provide a definite resolution.
We have involved the Directory services team in this regard for which you might receive calls from various tech engineers.”
Did you already have this symptom? What would you recommend us?
Thanks for your kindly answer & greetings from Switzerland, Ákos
Hi Jose,
At this moment this is AAD SSPR only.
Regards, Peter
That is correct, Rkast!
Hi Akos,
The latest version you mentioned is 1703. This functionality requires an Azure AD joined Windows 10, version 1709, or later, device.
Regards, Peter
I see you have OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Authentication/AllowAadPasswordReset
On blog post below Per does not append ./Device/
Can you elaborate the difference please ?
on https://osddeployment.dk/2017/11/02/how-to-enable-password-reset-from-windows-10-login-screen/
Hi RKast,
It’s the same. For device wide configuration the Device/ portion may be omitted from the path, see also: https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider
Regards, Peter
Sir Peter, thanks but what is the meaning of ‘device wide’ in this case? With /device we assign to device group is this different when leaving out the /device ? i simply dont understand.
Hi RKast,
There is no difference. Both configurations trigger the device configuration.
Regards, Peter
Nice Blog Peter!
Is this functionality supported with Hybrid AzureAD joined devices?
Hi Steve,
Not at this moment. At this moment it’s Azure AD joined only.
Regards, Peter