Reset a password in Microsoft 365: admin reset, change your own and self-service reset

Reset a user's password as an administrator, change your own password, and let people reset a forgotten password themselves with self-service password reset.

Who this is for: Microsoft 365 administrators who reset passwords for their users, and people with a work or school account who want to change or reset their own password.

This guide covers work and school accounts in Microsoft 365 for business, managed in the Microsoft 365 admin centre and the Microsoft Entra admin centre. It does not cover personal Microsoft accounts (such as Outlook.com or Xbox), and it does not cover resetting passwords with PowerShell or in an on-premises Active Directory. For those, see the related articles at the end.

Before you start

To reset another person's password you need an admin role that allows it. Password Administrator, Helpdesk Administrator and User Administrator can all reset passwords for users who have no admin role. Use the role with the fewest permissions that does the job.
Not every role can reset every password. A Password Administrator can reset only users with no admin role and a few limited roles. A Global Administrator's password can be reset only by a Privileged Authentication Administrator or another Global Administrator, and these two roles can reset any password.
You can only reset passwords for accounts that belong to your own organisation. Guests who sign in with an account from another organisation, a Microsoft account or a Google account must reset their password where that account lives.
If your users are synchronised from an on-premises Active Directory, you can reset their password in Microsoft 365 only when password writeback is turned on and the domain is managed, not federated. Otherwise reset the password in the on-premises Active Directory.
Self-service password reset is included in every paid Microsoft 365 business, education or nonprofit plan at no extra charge. It does not work in a Microsoft 365 trial. With an on-premises Active Directory it needs Microsoft Entra ID P1 or P2.

Reset a user's password in the Microsoft 365 admin centre

Use this when a user has forgotten their password, is locked out or never received a password, or when you think their account might be compromised.

Sign in to the Microsoft 365 admin centre with an account that has one of the roles above.
Go to Users > Active users.
Select the user's name, then select Reset password. The Reset password page opens.
Choose whether to automatically create a new password or type one yourself.
Select the option that requires the user to change their password when they first sign in (leave it selected if it already is). The user then replaces your password with one that only they know.
Select Reset password. The new password is shown.
Print the account details to a PDF and store the file in a secure place, then select Close.
Give the new password to the user securely, as described in the warning below.

Important Since 30 August 2024 the admin centre no longer sends account details and passwords by email, for security reasons. Do not paste the new password into an email or chat message either. Share it with the user directly, for example in person or by phone.

Check that it worked: ask the user to sign in with the new password. If you required a change, they are asked to choose their own password straight away. If the sign-in fails, see "When it goes wrong" below.

Reset up to 40 users at the same time

In the Microsoft 365 admin centre, go to Users > Active users.
Select the users. To select everyone, select the option next to Display name, then clear the tick next to your own name: you cannot reset your own password at the same time as other people's.
Select Reset password in the top row.
Choose the same options as for one user and select Reset password. If you chose to create the passwords automatically, the new temporary passwords are shown.
Print the account details to a PDF, store it in a secure place and share each password securely.

For more than 40 users, reset them in batches of 40 or use PowerShell (see the related article on bulk password reset).

If the account might be compromised or the person is leaving

A new password stops new sign-ins, but a person who is already signed in can keep working for up to an hour. To end their sessions as well (this needs the User Administrator or Helpdesk Administrator role, or Global Administrator for another administrator):

Reset the password as above.
Select the user's name again and open the Account tab.
Select Sign out of all sessions. Within an hour, or as soon as they leave the Microsoft 365 page they are on, they are asked to sign in again.

You can also select the user, then Block sign-in > Block this user from signing in > Save changes. Blocking can take up to 24 hours to work, so always reset the password first.

Reset a password in the Microsoft Entra admin centre

You can do the same reset in the Microsoft Entra admin centre:

Sign in to the Microsoft Entra admin centre as at least a Password Administrator.
Go to Entra ID > Users.
Select the user, then select Reset password.
On the Reset password page, select Reset password. A temporary password is created for you.
Copy the password and give it to the user securely. They must change it the next time they sign in.

Note A temporary password from the Microsoft Entra admin centre does not expire. It still works however long the user waits, so give it to them only when they are ready to sign in.

Change your own password

Use this when you know your current password and are not locked out.

Go to myaccount.microsoft.com and sign in with your work or school account and current password.
Select Change Password in the left pane.
Enter your old password, then enter your new password and enter it again to confirm it.
Select Submit. You are asked to sign in again with the new password.

If you have forgotten your password, you cannot use this page. Reset it with self-service password reset (below), or ask your administrator to reset it for you.

Turn on self-service password reset

Self-service password reset lets people reset a forgotten password themselves, after proving who they are with another method such as the Microsoft Authenticator app or their mobile phone. It saves you from resetting passwords by hand.

Microsoft names the Password Administrator role for opening this setting from the Microsoft 365 admin centre, and at least the Authentication Policy Administrator role for changing it in the Microsoft Entra admin centre. If Save is refused, ask someone with the Authentication Policy Administrator role.

Choose who can use it

In the Microsoft 365 admin centre, go to Settings > Org settings and select the Security & privacy tab.
Select Self-service password reset, then select Go to the Azure portal to turn on self-service password reset. The Password reset page opens in the Microsoft Entra admin centre. (In the Microsoft Entra admin centre you can also open it from Entra ID > Password reset.)
On the Properties page, under Self service password reset enabled, choose Selected to start with one test group, or All for everyone.
If you chose Selected, select No groups selected, find and select the group, then choose Select. Only one group can be chosen here.
Select Save.

Require two methods and registration

On the Authentication methods page of Password reset, set Number of methods required to reset to 2, then select Save. Two methods are more secure than one.
On the Registration page, set Require users to register when signing in to Yes.
Set Number of days before users are asked to reconfirm their authentication information to 180, then select Save. Out-of-date phone numbers or email addresses stop people from resetting their password.
On the Notifications page, set Notify users on password resets? and Notify all admins when other admins reset their password? to Yes, then select Save. People then hear about a reset they did not make.

Which methods people can register (for example a notification or code from the Authenticator app, email or a mobile phone) is set in your organisation's authentication methods policy in the Microsoft Entra admin centre.

Important Self-service password reset is only as safe as the methods people register. Turn on multi-factor authentication for all administrator accounts, and preferably for everyone. Administrators can use self-service password reset by default and must always prove their identity with two methods.

Test it with a user who is not an administrator

Open a private (InPrivate or incognito) browser window and go to aka.ms/ssprsetup.
Sign in as a test user in the group you chose, register the contact methods and select Looks good. Close the window.
Open a new private window and go to aka.ms/sspr.
Enter the test user's account name and the characters from the CAPTCHA, then select Next.
Follow the verification steps and choose a new password. When it works, the test user receives an email that the password was reset.

Reset your own forgotten password

You can do this only if your administrator has turned on self-service password reset for you and you have registered at least one verification method, such as the Authenticator app, a phone number or an email address.

Go to mysignins.microsoft.com/security-info.
On the sign-in screen, select Can't access your account?
Enter your work or school email address, type the characters from the CAPTCHA and select Next.
Choose a verification method and complete it. Your organisation may ask for a second one.
Enter your new password and confirm it. You can now sign in with it.

If you see a Contact your administrator link instead of these steps, self-service reset is not turned on for you. Use the link, or ask your administrator to reset your password as described above.

If you are an administrator and still signed in

If you have forgotten your admin password but are still signed in (for example, it is saved in your browser), make sure you can reset it before you sign out:

Select your name in the upper-right corner, then select View Account.
Check that your Alternate email is correct and that a mobile phone number is listed. If not, add them now.
Select your name > Sign out.
Sign in again: type your user name, select Next, then select Forgot password.
Follow the steps. Your alternate contact details are used to prove it is you.

When it goes wrong

Problem	Likely cause	What to do
You cannot reset the password of another administrator.	Your role can reset only users with no admin role or with certain lower roles.	Ask someone with the Privileged Authentication Administrator or Global Administrator role to reset it.
You cannot reset the password of a synchronised user.	Password writeback is off, or the domain is federated.	Reset the password in the on-premises Active Directory instead.
The reset fails for a synchronised user and the Microsoft Entra Connect server logs error hr=80231367.	The user's AdminCount attribute in Active Directory is set to 1.	An Active Directory administrator sets AdminCount to 0 for that user, then you reset the password again.
A user still has access just after the reset.	Their sign-in token is valid for up to an hour, and Outlook on the web keeps working until they open another app or refresh the page.	Select Sign out of all sessions on the user's Account tab.
The user sees "Please contact your administrator" when resetting their own password.	Self-service reset is not turned on or licensed for them, or their password is managed on-premises.	Reset the password for them (in the on-premises Active Directory if it is managed there), or add them to the group allowed to use self-service password reset.
The user sees "We couldn't verify your account."	They have not registered any verification method, or self-service reset is not turned on for your organisation.	Reset the password for them. Once they are signed in, they register their methods at mysignins.microsoft.com/security-info.
Changing or resetting the password gives an error.	The new password is too easy to guess.	Choose a longer, stronger password and try again.
Self-service password reset does not work at all.	The organisation is on a Microsoft 365 trial.	It works once you have a paid plan. Until then, reset passwords in the admin centre.