{
  "id": "CB-M365-AUTH-039",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-039",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-039.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-039.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-039",
    "title": "Enable self-service password reset for all users",
    "finding": {
      "title": "Self-service password reset is disabled or limited to a group",
      "description": "Users who forget their password or are locked out depend on the help desk, whose identity checks over the phone are a common social engineering target."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "sspr",
      "password-reset",
      "account-recovery",
      "help-desk"
    ],
    "description": "Self-service password reset (SSPR) is enabled with the scope **All**. Every user can reset a\nforgotten password or unlock their account after proving their identity with the authentication\nmethods they registered, without calling the help desk.\n\nAdministrators always use the separate administrator reset policy (two methods, set by\nMicrosoft) whatever this scope.\n",
    "rationale": "A recovery path that relies on a human verifying identity over the phone is what attackers abuse\nto take over accounts (help-desk social engineering). A self-service reset based on registered\nmethods is both faster for users and harder to talk through. It also lets users clear a smart\nlockout (CB-M365-AUTH-038) themselves.\n",
    "impact": "Users must register reset methods (CB-M365-AUTH-041). For synchronized users, the reset only works\non-premises if password writeback is enabled in Microsoft Entra Connect or Cloud Sync. Help-desk\nprocedures change: the help desk no longer resets passwords on a phone call alone.\n",
    "notes": "There is no Microsoft Graph API to read the SSPR scope: the check is made in the portal. SSPR for\ncloud users needs at least a Microsoft 365 business plan or Microsoft Entra ID P1; writeback for\nhybrid users needs P1.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Password reset > Properties > Self service password reset enabled",
      "default_value": "None",
      "recommended_value": "All"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Password reset** > **Properties**.\n3. Check that **Self service password reset enabled** is set to **All**.\n4. For hybrid tenants, browse to **Password reset** > **On-premises integration** and check that\n   password writeback is enabled.\n5. Fail if the setting is **None** or **Selected**.\n"
    },
    "remediation": {
      "manual": "1. Make sure the authentication methods and registration settings are ready\n   (CB-M365-AUTH-040, CB-M365-AUTH-041) and, for hybrid users, that password writeback is\n   enabled in the sync client.\n2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n3. Browse to **Entra ID** > **Password reset** > **Properties**.\n4. Pilot with **Selected** and a test group if SSPR was never used, then set **Self service\n   password reset enabled** to **All** and **Save**.\n5. Update the help-desk procedure and inform users (https://aka.ms/sspr to reset,\n   https://aka.ms/mysecurityinfo to register).\n",
      "rollback": "Set the scope back to **Selected** with a group, or **None**.\n"
    },
    "references": [
      {
        "title": "Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset",
        "url": "https://learn.microsoft.com/entra/identity/authentication/tutorial-enable-sspr",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "How self-service password reset works",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-sspr-howitworks",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-mfa",
        "framework_version": "2.0",
        "id": "R30",
        "relation": "partial",
        "note": "ANSSI asks for an access recovery method in general; ours provides it through SSPR for passwords only."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-038",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-040",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-041",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-042",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-043",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-030",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-009",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-015",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}