Reset a User's Password and Send a Welcome Email with Credentials via Microsoft Graph

Manual walkthrough — Microsoft 365 Admin Center

Step 1: Reset the password

1. Sign in to the Microsoft 365 Admin Center at https://admin.microsoft.com.
2. Navigate to Users → Active users.
3. Search for the target user and click their display name to open the details pane.
4. Click Reset password at the top of the pane.
5. Choose Let me create the password and enter a strong temporary password (or choose Auto-generate).
6. Check Require this user to change their password when they first sign in.
7. Click Reset password. Copy the password from the confirmation screen — it will not be shown again.

Step 2: Send the welcome email

1. Open Outlook (web or desktop) signed in as the admin.
2. Compose a new message to the user's external address (e.g., their personal or prior-employer email).
3. Paste the welcome email template and fill in the UPN and temporary password.
4. If available, enable Encrypt (Options → Encrypt → Encrypt-Only) to protect the credentials in transit.
5. Send.

Privileged accounts — alternative path

If the user holds an admin role and the reset above is blocked, use:

1. Navigate to the Microsoft Entra admin center → Users → [select user] → Authentication methods.
2. Click Reset password at the top. You must be signed in with Privileged Authentication Administrator or Global Administrator role.
3. Copy the auto-generated password and deliver it via the welcome email.

Microsoft Graph API recipe

1. Resolve the user

GET https://graph.microsoft.com/v1.0/users?$filter=userPrincipalName eq '{upn}'&$select=id,displayName,userPrincipalName,accountEnabled

Store the returned id for subsequent calls.

2. (Optional) Check for directory roles

If the user holds a privileged role, you'll need the Authentication Methods API fallback:

GET https://graph.microsoft.com/v1.0/users/{id}/memberOf/microsoft.graph.directoryRole?$select=id,displayName

3a. Standard password reset (non-privileged users)

PATCH https://graph.microsoft.com/v1.0/users/{id}
Content-Type: application/json

{
  "passwordProfile": {
    "forceChangePasswordNextSignIn": true,
    "password": "{temporaryPassword}"
  }
}

Expected response: 204 No Content.

3b. Privileged-account fallback — Authentication Methods API

If the PATCH returns 403 Insufficient privileges, the user is likely an admin. Use:

POST https://graph.microsoft.com/v1.0/users/{id}/authentication/methods/{methodId}/resetPassword
Content-Type: application/json

{
  "newPassword": "{temporaryPassword}"
}

Where {methodId} is the ID of the user's existing password authentication method, retrieved via GET /users/{id}/authentication/passwordMethods. The caller must have UserAuthenticationMethod.ReadWrite.All and the Privileged Authentication Administrator role.

4. Send the welcome email

POST https://graph.microsoft.com/v1.0/me/sendMail
Content-Type: application/json

{
  "message": {
    "subject": "Welcome to {ProgramName}",
    "body": {
      "contentType": "Text",
      "content": "Hi {FirstName},\n\nYour account is ready.\n\nUsername: {upn}\nTemporary Password: {temporaryPassword}\n\nLogin: https://login.microsoftonline.com/\n\nPlease change your password on first sign-in."
    },
    "toRecipients": [
      { "emailAddress": { "address": "{externalEmail}" } }
    ]
  },
  "saveToSentItems": true
}

Expected response: 202 Accepted.

PowerShell walkthrough (Microsoft Graph SDK)

This approach uses the Microsoft.Graph PowerShell module and works for both standard and privileged users.

1. Install and connect

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.ReadWrite.All","UserAuthenticationMethod.ReadWrite.All","Mail.Send","Directory.Read.All"

2. Generate a strong temporary password

Add-Type -AssemblyName System.Web
$tempPassword = [System.Web.Security.Membership]::GeneratePassword(14, 3)

3. Resolve the user and attempt the standard reset

$user = Get-MgUser -UserId $Upn
$profile = @{ Password = $tempPassword; ForceChangePasswordNextSignIn = $true }
Update-MgUser -UserId $user.Id -PasswordProfile $profile

4. Fallback for privileged users

If step 3 throws a 403, call the Authentication Methods endpoint:

$method = Get-MgUserAuthenticationPasswordMethod -UserId $user.Id
Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/v1.0/users/$($user.Id)/authentication/methods/$($method.Id)/resetPassword" `
  -Body (@{ newPassword = $tempPassword } | ConvertTo-Json)

5. Send the welcome email

Send-MgUserMail -UserId (Get-MgContext).Account -BodyParameter $mailPayload

The downloadable script below wraps all of this with parameters, error handling, and the fallback path.