Reset a User's Password in Entra ID via Microsoft Graph

Password resets are one of the most common helpdesk tickets. When a user is locked out of their work account, IT needs a fast, auditable way to issue a temporary password and get them back to work — while preserving security posture.

This recipe covers the end-to-end flow: verifying the user exists, generating a cryptographically secure temporary password, applying the reset via Microsoft Graph, and guiding the user through first sign-in. It also covers the common edge case where the target user holds a privileged role (Global Admin, Privileged Authentication Admin, etc.), in which case the standard passwordProfile PATCH is blocked and you must fall back to the Authentication Methods API.

When to use this recipe

• User reports they cannot sign in and self-service password reset (SSPR) is not configured or not working.
• User's account was compromised and you want to force a credential rotation alongside session revocation.
• Onboarding handoff where a temporary password needs to be communicated out-of-band.

After completing this recipe you will have:

• Verified the target user account exists and is enabled in Entra ID.
• Generated a 14-character cryptographically random temporary password.
• Applied the password reset via Microsoft Graph with forceChangePasswordNextSignIn = true.
• Optionally revoked existing sign-in sessions so the old credentials can't be reused.
• Communicated the temporary password to the user through a secure out-of-band channel.
• An audit trail in the Entra ID sign-in and audit logs.

Security considerations

• Never send the temp password over email to the same account you just reset — the user can't read it. Use SMS, a secondary personal email on file, or a manager handoff.
• Verify identity before resetting. Social engineering attacks frequently target the helpdesk. Confirm the requester via a second factor (Teams video call, manager approval, ID check).
• Privileged accounts are protected. If the target holds an admin role, a plain PATCH /users/{id} with a passwordProfile will return 403 Forbidden unless the caller holds Privileged Authentication Administrator. Use the Authentication Methods API (/authentication/passwordMethods/{id}/resetPassword) instead.
• Hybrid-joined users: if the account is synced from on-prem AD, you must reset the password in on-prem AD — the Graph call will fail with Unable to update the specified properties for on-premises mastered Directory Sync objects.
• Always force change at next sign-in so the admin-chosen password never persists as the user's working credential.
• Revoke sessions (POST /users/{id}/revokeSignInSessions) if you suspect compromise — otherwise existing refresh tokens remain valid.