Notify all Global Administrators when an administrator resets their password

Description

In the self-service password reset settings, Notify all admins when other admins reset their password? is Yes. When an administrator resets their own password with SSPR, every Global Administrator receives an email at their primary address.

Only Global Administrators are notified. Alerting the SOC on the corresponding audit event (Reset password (self-service) on a privileged account) gives a more reliable signal; it is covered by the audit domain.

Rationale

A reset of an administrator password is rare and sensitive. Informing the other administrators gives a second pair of eyes: an unexpected reset of a colleague's account is a strong signal of takeover that can be checked within minutes.

Impact

Global Administrators receive an email for each administrator self-service reset. If Global Administrators have no monitored mailbox, route the notifications to the security team with the SSPR customization link or a mail flow rule.

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Password reset > Notifications.
3. Check that Notify all admins when other admins reset their password? is Yes.
4. Fail if it is No.

Remediation

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Entra ID > Password reset > Notifications.
3. Set Notify all admins when other admins reset their password? to Yes and Save.

Rollback

Set the option to No.

References

• How self-service password reset works - notifications Microsoft, vendor-doc, accessed 2026-10-24
• Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-M365-AUTH-039 Enable self-service password reset for all users
• related CB-M365-AUTH-042 Notify users when their password is reset

People and lifecycle