Password & Account Recovery

How to Disable Self-Service Password Reset in Microsoft Entra ID

Natalie Taylor Oct 21, 2026 868 views

Question details

The user needs to restrict or disable the Self-Service Password Reset (SSPR) feature in Microsoft Entra ID to ensure only designated users or administrators can change passwords.

How to Disable Self-Service Password Reset in Microsoft Entra ID

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: Managing organizational security policies and user password reset permissions.
Observed behavior: Restricting password reset capabilities to a specific security group or disabling the self-service reset feature entirely for standard users.

Before you start

Ensure you have at least the Global Administrator or Authentication Policy Administrator role assigned in Microsoft Entra ID to modify self-service password reset configurations.

Solution 1Recommended

Restrict or Disable SSPR via Microsoft Entra ID Properties

Modify the Self-Service Password Reset enabled scope to restrict access to a specific security group or disable it entirely for standard users.

Organizations can manage the SSPR scope to ensure only authorized users can reset their own passwords. By default, you can restrict this feature by setting the scope to 'Selected' and assigning it to a specific security group, or selecting 'None' to disable it entirely for standard users.

Sign in to Microsoft Entra admin center

Navigate to Password Reset

On the left sidebar, expand the 'Identity' menu, go to 'Protection', and select 'Password reset'.

Modify the Enabled Scope

Under the 'Properties' page, locate the 'Self service password reset enabled' setting. Choose 'None' to disable SSPR for everyone, or choose 'Selected' to limit access.

Select a Security Group (Optional)

If you chose 'Selected', click on the 'Select group' option and choose the specific security group that should retain password reset capabilities. Remove any users from this group who should not have access.

Save the Configuration

Click the 'Save' button at the top of the page. Users outside the configured scope will immediately lose the ability to reset their own passwords.

Restrict or Disable SSPR via Microsoft Entra ID Properties

Administrator Exemption: Microsoft Entra ID enforces a default password reset policy for administrators. Even if SSPR is set to 'None', designated admins will still retain the ability to reset their own passwords.

Free Microsoft Office alternative

Equip Your Team with WPS Office as a Cost-Effective Alternative

While you manage your organization's security settings in Microsoft Entra ID, consider equipping your team with a lightweight, comprehensive office suite. WPS Office provides robust word processing, spreadsheet, and presentation tools that are fully compatible with Microsoft Office formats.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install WPS Office: Run the downloaded installer and follow the on-screen prompts to complete the fast setup process.
3. Open Existing Documents: Launch WPS Office and instantly open your existing Microsoft Word, Excel, and PowerPoint files without any formatting loss.

Seamless compatibility with Microsoft Office formats (.docx, .xlsx, .pptx)Familiar user interface reduces the learning curve for your teamLightweight installation and resource-friendly performance across devicesFree alternative to traditional expensive office suites for document management

microsoft office alternative - wps office

Frequently Asked Questions

How do I disable Self-Service Password Reset for just one specific user?

SSPR targeting in Microsoft Entra ID is managed at the group level, not per individual user. To restrict a specific user, you must set the SSPR scope to 'Selected', assign a security group to that scope, and ensure the user you wish to restrict is removed from that specific group.

What message do users see when SSPR is disabled for them?

When users who are outside the enabled SSPR scope attempt to reset their password, they will receive a message stating that their account is not enabled for password reset and they must contact their IT administrator or helpdesk for assistance.

Does disabling SSPR affect password writeback to on-premises Active Directory?

If a user is not in the allowed SSPR scope, they cannot trigger the password reset flow from the cloud, which means password writeback will not be initiated by them. However, password writeback will still function for users who remain in the allowed scope or when administrators reset passwords from the admin center.

Login & Account Issues