Why Exchange Administrators Cannot Reset Microsoft 365 User Passwords
Question details
Users holding the Exchange Administrator role are unable to reset passwords or block user sign-ins for Microsoft 365 accounts.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Attempting to manage Microsoft 365 user credentials and security access from the admin center.
- Observed behavior
- The options to reset user passwords or block sign-ins are unavailable or disabled, preventing the Exchange Administrator from performing basic account recovery tasks.
Ensure you have Global Administrator or Privileged Role Administrator rights in Microsoft Entra ID (formerly Azure AD) before attempting to modify administrative role assignments.
Assign the User Administrator or Helpdesk Administrator Role
Grant the necessary Microsoft Entra ID permissions to the user so they can manage identity and credential resets.
The Exchange Administrator role is explicitly designed for managing email systems, mailboxes, and Exchange Online settings. It does not include broad identity-management permissions across Microsoft 365.
To allow an administrator to reset passwords without granting them global access, you must assign an appropriate secondary role.
Sign in to the Microsoft 365 admin center using an account with Global Administrator privileges.
In the left-hand navigation menu, select 'Users', then click on 'Active users'.
Locate and click on the name of the Exchange Administrator who requires password reset permissions to open their properties pane.
Click on 'Manage roles'. In the role selection list, check the box for 'User Administrator' or 'Helpdesk Administrator'.
Click 'Save changes'. The administrator may need to sign out and sign back in for the new permissions to take effect.
Experience Hassle-Free Document Work with WPS Office
While managing Microsoft 365 admin permissions can be complex, your daily document workflows shouldn't be. WPS Office offers a free, lightweight, and powerful alternative to Microsoft Office. Enjoy seamless format compatibility without the overhead of complex enterprise configurations.
- 1. Download WPS Office: Visit the official WPS Office website and download the free installation package for your PC or Mac.
- 2. Install the Software: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
- 3. Open and Edit Your Files: Launch WPS Office and immediately start opening, editing, and saving your existing Microsoft Word, Excel, and PowerPoint files.
Frequently Asked Questions
Can an Exchange Administrator block user sign-ins?
No, blocking user sign-ins is an identity management action. Like password resets, this requires the User Administrator, Global Administrator, or a similar identity-focused role in Microsoft Entra ID.
Why did my Exchange Admin suddenly lose password reset abilities?
Microsoft regularly updates its security policies to enforce the principle of least privilege. If your role scope was recently audited or updated, identity-management permissions may have been separated from your email-management roles.
What is the difference between User Administrator and Helpdesk Administrator?
A User Administrator can create, delete, and manage full user lifecycle settings, including password resets. A Helpdesk Administrator can only change passwords, force users to sign out, and manage service requests, making it a safer choice for basic support staff.
