'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Password Reset Options for Microsoft 365 Hybrid Users Without SSPR Licensing
Question details
IT administrators need a method for non-domain-joined remote employees to reset their on-premises domain passwords after migrating to Exchange Online, without purchasing an Entra ID SSPR writeback license.
- Product
- Microsoft 365 / Exchange Hybrid
- Device & OS
- not provided
- Scenario
- Remote employees using a VPN to access company resources need a way to reset their passwords after the legacy Exchange 2016 OWA portal was retired.
- Observed behavior
- Users have lost the ability to reset passwords because the old OWA portal is gone, and Entra self-service password reset (SSPR) writeback is not licensed.
Verify your current Microsoft Entra ID (formerly Azure AD) licensing tier in the Microsoft 365 admin center to confirm whether SSPR writeback is completely unavailable to your tenant.
Consult the Microsoft Exchange Hybrid Management Forum
Since hybrid identity and on-premises Exchange administration present complex security challenges, seeking specialized assistance from Microsoft's official channels is highly recommended.
Microsoft provides dedicated forums and guidance for improving sign-in security for hybrid workers, particularly when configuring multifactor authentication (MFA) and managing non-domain-joined remote computers.
Navigate to the Microsoft Learn documentation portal and review the latest guidance on hybrid identity management and MFA for remote workers.
Go to the Microsoft Q&A website and search for the 'Microsoft Exchange Hybrid Management' tag.
Post a detailed question outlining your Exchange 2016 OWA migration, the lack of SSPR licensing, and the non-domain-joined status of your remote computers to receive tailored advice from Microsoft engineers.
Deploy an Alternative On-Premises Web Portal
If you cannot use cloud-based SSPR, you can deploy a secure, on-premises web portal designed for remote password resets over the VPN.
Evaluate Licensing Upgrades for Native SSPR
Upgrading to a license that includes Entra ID P1 is often the most secure and native way to restore password reset functionality for hybrid users.
Looking for a flexible alternative for your remote workforce?
While resolving complex Microsoft 365 hybrid identity issues, ensure your remote employees stay productive. WPS Office provides a lightweight, cost-effective alternative to Microsoft Office that is easy to deploy on non-domain-joined computers without complex cloud identity dependencies.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package.
- 2. Deploy to Remote Users: Distribute the lightweight installer to your non-domain-joined remote computers via your preferred endpoint management tool.
- 3. Start Creating: Open WPS Office and immediately start editing documents, spreadsheets, and presentations with full Microsoft format compatibility.
Frequently Asked Questions
Can I enable password writeback without an Entra ID P1 license?
No, password writeback is a premium feature that requires at least a Microsoft Entra ID P1 (formerly Azure AD Premium P1) license. Without it, cloud password changes will not sync back to your on-premises Active Directory.
Why did we lose password reset capabilities after migrating to Exchange Online?
The legacy on-premises Exchange OWA portal included a built-in password change feature connected directly to your local Active Directory. By migrating to Exchange Online, OWA is now hosted in the cloud, breaking the direct link to your local AD unless SSPR writeback is configured.
How can non-domain-joined remote users change passwords without OWA?
Without cloud SSPR, remote users must either connect via VPN to access a custom on-premises web portal, or IT administrators must manually reset their passwords in Active Directory and securely provide them with the new credentials.
