How to Fix Azure AD Self-Service Password Reset Error SSPR_0029
Question details
Azure Active Directory self-service password reset fails with error SSPR_0029 for synchronized users.
- Product
- Azure Active Directory / Office 365 E3
- Device & OS
- not provided
- Scenario
- Attempting to reset an account password through the self-service portal (aka.ms/sspr) with password writeback enabled.
- Observed behavior
- The password reset fails with the SSPR_0029 error code, even though regular password changes made in the Office 365 portal write back successfully to the on-premises Active Directory.
Ensure you have Domain Administrator or Enterprise Administrator credentials to modify object permissions within your on-premises Active Directory.
Grant Required Permissions to the Azure AD Connect Sync Account
Resolve the SSPR_0029 error by ensuring the Azure AD Connect synchronization account has the appropriate reset and write permissions on the affected Active Directory user objects.
The SSPR_0029 error specifically indicates a permissions issue where the Azure AD Connect service account lacks the authority to write back the new password or modify password-related attributes in the local Active Directory. This often happens if permission inheritance is broken on specific Organizational Units (OUs) or users.
Log in to your domain controller and launch 'Active Directory Users and Computers' (ADUC).
Click on the 'View' menu at the top and select 'Advanced Features' to reveal security tabs on directory objects.
Right-click the specific Domain or Organizational Unit (OU) containing the affected synchronized users, select 'Properties', and navigate to the 'Security' tab.
Click the 'Advanced' button. Find your Azure AD Connect synchronization account in the list or click 'Add' to include it.
Edit the account permissions. Check the boxes for 'Reset password', 'Change password', and grant 'Write' permissions specifically for 'lockoutTime' and 'pwdLastSet'.
In the 'Applies to' dropdown menu, select 'Descendant User objects'. Ensure the checkbox to enable permission inheritance is selected, then click 'Apply' and 'OK'.
Switch to WPS Office for a Streamlined Experience
Enterprise directory synchronization and Azure AD permissions can be complex to manage. If you are looking for a reliable, standalone office suite that avoids the overhead of Microsoft 365 cloud management, WPS Office provides a lightweight, highly compatible alternative.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Run the Setup: Open the downloaded executable file and follow the straightforward installation prompts.
- 3. Start Creating: Launch WPS Office to instantly begin creating, editing, and saving your documents in standard Microsoft formats.
Frequently Asked Questions
What does the Azure AD error SSPR_0029 mean?
Error SSPR_0029 means that the backend synchronization account (Azure AD Connect) does not have sufficient permissions in your on-premises Active Directory to perform a password reset or modify password metadata for the target user.
Why do normal portal password changes work while self-service resets fail?
Standard portal password changes and the self-service password reset (SSPR) tool utilize different mechanisms and permission checks. If writeback permissions or inheritance are broken on specific user objects, SSPR will fail with SSPR_0029 even if standard sync operations succeed.
Do I need a specific license for password writeback to function?
Yes. Password writeback is a premium Azure Active Directory feature. Your organization must have at least an Azure AD Premium P1 license (which is included in enterprise plans like Office 365 E3 and E5) to enable and use self-service password reset with on-premises writeback.
