Disable self-service password reset for administrators

Description

The tenant authorization policy sets allowedToUseSSPR to false, so accounts holding an administrative role cannot use self-service password reset. Their password (if they still use one) is reset by another administrator with the Privileged Authentication Administrator role.

The setting has no portal toggle. It can take up to 60 minutes to apply.

Rationale

The administrator SSPR policy is managed by Microsoft and always accepts two methods among mobile phone, email and app, which can be taken over through SIM swapping or a compromised personal mailbox. Turning it off removes this recovery path for the most valuable accounts. Administrators who sign in with passkeys do not need password reset anyway.

Impact

An administrator who forgets a password must ask another administrator, which needs a documented and staffed procedure. Emergency access accounts are not affected because they use security keys.

Setting

Audit

1. Connect to Microsoft Graph PowerShell with a Global Reader account (scope Policy.Read.All).
2. Run (Get-MgPolicyAuthorizationPolicy).AllowedToUseSspr, or call GET https://graph.microsoft.com/v1.0/policies/authorizationPolicy and read allowedToUseSSPR.
3. Fail if the value is true.

Remediation

1. Make sure a password reset procedure exists for administrators (Privileged Authentication Administrator, identity check of the requester).
2. Connect to Microsoft Graph PowerShell as at least a Privileged Role Administrator (scope Policy.ReadWrite.Authorization).
3. Run Update-MgPolicyAuthorizationPolicy -AllowedToUseSspr:$false, or call PATCH https://graph.microsoft.com/v1.0/policies/authorizationPolicy with {"allowedToUseSSPR": false}.

Rollback

Run Update-MgPolicyAuthorizationPolicy -AllowedToUseSspr:$true.

References

• Self-service password reset policies, administrator reset policy differences Microsoft, vendor-doc, accessed 2026-10-24
• authorizationPolicy resource type Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-039 Enable self-service password reset for all users

People and lifecycle