Notify users when their password is reset

Description

In the self-service password reset settings, Notify users on password resets? is Yes. After each reset, Microsoft Entra ID sends an email to the user's primary and alternate addresses (or the user principal name if none is set).

Rationale

The notification is often the first sign of an account takeover through the reset process. A user who did not request the reset can report it at once and the account can be recovered before the attacker does much.

Impact

None known. Messages come from [email protected] or [email protected]; make sure they are not filtered as spam.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Password reset > Notifications.
3. Check that Notify users on password resets? is Yes.
4. Fail if it is No.

Remediation

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Entra ID > Password reset > Notifications.
3. Set Notify users on password resets? to Yes and Save.
4. Tell users to report any reset notification they did not expect.

Rollback

Set the option to No.

References

• How self-service password reset works - notifications Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-M365-AUTH-039 Enable self-service password reset for all users
• related CB-M365-AUTH-043 Notify all Global Administrators when an administrator resets their password

People and lifecycle