Skip to content
Forestall

AZ_RESET_PASSWORD

Copy page

Summary
Forestall ACL Alias AZ_RESET_PASSWORD
Azure Alias Reset user passwords
Affected Object Types AZ Users
Exploitation Certainty Certain
Graph Permission / Role Global Administrator, Privileged Authentication Administrator, Authentication Administrator, User Administrator, Password Administrator / Helpdesk Administrator, Partner Tier1 Support, Partner Tier2 Support.

Description

AZ_RESET_PASSWORD represents the ability for a principal (user, service principal, or group) to reset another user’s password in Microsoft Entra ID.

Resetting a password grants the actor full access to the target user’s account, allowing them to:

  • Sign in as the user using the new password.
  • Access all cloud resources the user can access (Azure, M365, SaaS apps).
  • Perform privileged operations as the target if the user has admin rights.
  • In hybrid environments with password write-back enabled, reset the on-prem Active Directory password as well - enabling full compromise of on-prem infrastructure.

Because password reset = account takeover, AZ_RESET_PASSWORD is one of the most sensitive capabilities in Entra ID.

Identification

PowerShell (Microsoft Graph)

List users who can reset passwords by directory role:

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"


# Role template IDs for password reset capable roles
$roleIds = @{
    "62e90394-69f5-4237-9190-012177145e10" = "Global Administrator"
    "7be44c8a-adaf-4e2a-84d6-ab2649e08a13" = "Privileged Authentication Administrator"
    "c4e39bd9-1100-46d3-8c65-fb160da0071f" = "Authentication Administrator"
    "fe930be7-5e62-47db-91af-98c3a49a38b1" = "User Administrator"
    "966707d0-3269-4727-9be2-8c3a10f19b9d" = "Password Administrator"
    "729827e3-9c14-49f7-bb1b-9608f156bbb8" = "Helpdesk Administrator"
    "4ba39ca4-527c-499a-b93d-d9b492c50246" = "Partner Tier1 Support"
    "e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8" = "Partner Tier2 Support"
}


$roleIds.Keys | ForEach-Object {
    $roleDefId = $_
    $roleName = $roleIds[$_]
    Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$roleDefId'" -ExpandProperty Principal -ErrorAction SilentlyContinue | ForEach-Object {
        [PSCustomObject]@{
            Role = $roleName
            PrincipalType = $_.Principal.AdditionalProperties.'@odata.type'.Split('.')[-1]
            DisplayName = $_.Principal.AdditionalProperties.displayName
            PrincipalId = $_.PrincipalId
        }
    }
} | Format-Table -AutoSize

Exploitation

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All"


$userId = "<TargetUserObjectId>"
$newPassword = "passhere"


$params = @{
    passwordProfile = @{
        forceChangePasswordNextSignIn = $false
        password = $newPassword
    }
}
Update-MgUser -UserId $userId -BodyParameter $params -Verbose
Reset a user password with Microsoft Graph PowerShell

Reset a user password with Microsoft Graph PowerShell

Azure Portal

  1. Open Microsoft Entra admin center -> Identity -> Users
  2. Select the target user
  3. Click Reset password
  4. Generate a new password or receive the automatically created temporary password

You can now sign in as that user (subject to MFA).

Mitigation

  1. Limit directory roles that can reset passwords

    1. Open Microsoft Entra admin center -> Roles & administrators

    2. Review assignments for:

      • Global Administrator
      • Privileged Authentication Administrator
      • Authentication Administrator
      • User Administrator
      • Password Administrator / Helpdesk Administrator
      • Partner Tier1 Support
      • Partner Tier2 Support

    3. Remove permissions where not required

      -> select assignment -> Remove assignment

    4. For roles assigned to groups:

      • Ensure group membership is tightly controlled
      • Avoid broad groups like “All IT”
  2. Harden password reset & hybrid flows
    1. Go to Identity -> Protection -> Password reset
    2. Restrict SSPR to specific groups, not all users
    3. Require strong authentication methods for resets
    4. If password write-back is enabled:
      • Ensure only required identities can reset hybrid passwords
      • Regularly review privileged hybrid accounts

Detection

Use the Microsoft Entra admin center:

  1. Open Microsoft Entra ID -> Audit logs.
  2. Filter Activity for Reset password or Reset user password.
  3. Filter Category for UserManagement.
  4. Review Initiated by (actor), Target, Date, and Status for unexpected password resets.
  5. Use Manage view -> Edit columns if any of those fields are hidden.

References

Was this page helpful?

Thank you for your feedback.