{
  "id": "CB-M365-AUTH-043",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-043",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-043.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-043.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-043",
    "title": "Notify all Global Administrators when an administrator resets their password",
    "finding": {
      "title": "Administrator password resets through SSPR are not reported to the other administrators",
      "description": "A takeover of a privileged account through the reset process goes unnoticed by the people best placed to react."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "sspr",
      "notifications",
      "privileged-access",
      "account-recovery"
    ],
    "description": "In the self-service password reset settings, **Notify all admins when other admins reset their\npassword?** is **Yes**. When an administrator resets their own password with SSPR, every Global\nAdministrator receives an email at their primary address.\n",
    "rationale": "A reset of an administrator password is rare and sensitive. Informing the other administrators\ngives a second pair of eyes: an unexpected reset of a colleague's account is a strong signal of\ntakeover that can be checked within minutes.\n",
    "impact": "Global Administrators receive an email for each administrator self-service reset. If Global\nAdministrators have no monitored mailbox, route the notifications to the security team with the\nSSPR customization link or a mail flow rule.\n",
    "notes": "Only Global Administrators are notified. Alerting the SOC on the corresponding audit event\n(**Reset password (self-service)** on a privileged account) gives a more reliable signal; it is\ncovered by the audit domain.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Password reset > Notifications > Notify all admins when other admins reset their password?",
      "default_value": "No",
      "recommended_value": "Yes"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Password reset** > **Notifications**.\n3. Check that **Notify all admins when other admins reset their password?** is **Yes**.\n4. Fail if it is **No**.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n2. Browse to **Entra ID** > **Password reset** > **Notifications**.\n3. Set **Notify all admins when other admins reset their password?** to **Yes** and **Save**.\n",
      "rollback": "Set the option to **No**.\n"
    },
    "references": [
      {
        "title": "How self-service password reset works - notifications",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-sspr-howitworks",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Tutorial: Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset",
        "url": "https://learn.microsoft.com/entra/identity/authentication/tutorial-enable-sspr",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2(4)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1098"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-039",
        "type": "requires"
      },
      {
        "id": "CB-M365-AUTH-042",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}