AZ_RESET_PASSWORD

Summary

FSProtect ACL Alias	AZ_RESET_PASSWORD
Azure Alias	Reset user passwords
Affected Object Types	AZ Users
Exploitation Certainty	Certain
Graph Permission / Role	Global Administrator, Privileged Authentication Administrator, Authentication Administrator, User Administrator, Password Administrator / Helpdesk Administrator, Partner Tier1 Support, Partner Tier2 Support.

Description

AZ_RESET_PASSWORD represents the ability for a principal (user, service principal, or group) to reset another user’s password in Microsoft Entra ID.

Resetting a password grants the actor full access to the target user’s account, allowing them to:

• Sign in as the user using the new password.

• Access all cloud resources the user can access (Azure, M365, SaaS apps).

• Perform privileged operations as the target if the user has admin rights.

• In hybrid environments with password write-back enabled, reset the on-prem Active Directory password as well - enabling full compromise of on-prem infrastructure.

Because password reset = account takeover, AZ_RESET_PASSWORD is one of the most sensitive capabilities in Entra ID.

Identification

PowerShell (Microsoft Graph)

List users who can reset passwords by directory role:

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"

# Role template IDs for password reset capable roles
$roleIds = @{
    "62e90394-69f5-4237-9190-012177145e10" = "Global Administrator"
    "7be44c8a-adaf-4e2a-84d6-ab2649e08a13" = "Privileged Authentication Administrator"
    "c4e39bd9-1100-46d3-8c65-fb160da0071f" = "Authentication Administrator"
    "fe930be7-5e62-47db-91af-98c3a49a38b1" = "User Administrator"
    "966707d0-3269-4727-9be2-8c3a10f19b9d" = "Password Administrator"
    "729827e3-9c14-49f7-bb1b-9608f156bbb8" = "Helpdesk Administrator"
    "4ba39ca4-527c-499a-b93d-d9b492c50246" = "Partner Tier1 Support"
    "e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8" = "Partner Tier2 Support"
}

$roleIds.Keys | ForEach-Object {
    $roleDefId = $_
    $roleName = $roleIds[$_]
    Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$roleDefId'" -ExpandProperty Principal -ErrorAction SilentlyContinue | ForEach-Object {
        [PSCustomObject]@{
            Role = $roleName
            PrincipalType = $_.Principal.AdditionalProperties.'@odata.type'.Split('.')[-1]
            DisplayName = $_.Principal.AdditionalProperties.displayName
            PrincipalId = $_.PrincipalId
        }
    }
} | Format-Table -AutoSize

Azure CLI

az rest --method GET --url 'https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?$filter=roleDefinitionId eq '\''966707d0-3269-4727-9be2-8c3a10f19b9d'\''&$expand=principal'

PowerShell:

az rest --method GET --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?`$filter=roleDefinitionId eq '966707d0-3269-4727-9be2-8c3a10f19b9d'&`$expand=principal"

Relevant role template IDs:

Role	Template ID
Global Administrator	62e90394-69f5-4237-9190-012177145e10
Privileged Authentication Administrator	7be44c8a-adaf-4e2a-84d6-ab2649e08a13
Authentication Administrator	c4e39bd9-1100-46d3-8c65-fb160da0071f
User Administrator	fe930be7-5e62-47db-91af-98c3a49a38b1
Password Administrator	966707d0-3269-4727-9be2-8c3a10f19b9d
Helpdesk Administrator	729827e3-9c14-49f7-bb1b-9608f156bbb8
Partner Tier1 Support	4ba39ca4-527c-499a-b93d-d9b492c50246
Partner Tier2 Support	e00e864a-17c5-4a4b-9c06-f5b95a8d5bd8

Anyone assigned (directly or via group) to these roles effectively has AZ_RESET_PASSWORD.

Azure GUI

1. Directory roles whose members can reset passwords

   1. Open Microsoft Entra admin center.

   2. Go to Identity -> Roles & administrators.

   3. Locate these roles:

      • Global Administrator (GA)

      • Privileged Authentication Administrator (PRA)

      • Authentication Administrator

      • User Administrator

      • Password Administrator / Helpdesk Administrator

      • Partner Tier1 Support

      • Partner Tier2 Support

   4. Click each -> Assignments:

      • Any assigned user, service principal, or group can reset passwords.

      • If a group is assigned, enumerate all transitive members.

2. Per-user confirmation

   1. Open Identity -> Users.

   2. Select a target user.

   3. If Reset password is enabled, your identity has AZ_RESET_PASSWORD over that user.

Exploitation

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All"

$userId = "<TargetUserObjectId>"
$newPassword = "passhere"

$params = @{
    passwordProfile = @{
        forceChangePasswordNextSignIn = $false
        password = $newPassword
    }
}
Update-MgUser -UserId $userId -BodyParameter $params -Verbose

Change Pass Powershell

Azure GUI

1. Open Microsoft Entra admin center -> Identity -> Users

2. Select the target user

3. Click Reset password

4. Generate a new password or receive the automatically created temporary password

You can now sign in as that user (subject to MFA).

Mitigation

1. Limit directory roles that can reset passwords

   1. Open Microsoft Entra admin center -> Roles & administrators

   2. Review assignments for:

      • Global Administrator

      • Privileged Authentication Administrator

      • Authentication Administrator

      • User Administrator

      • Password Administrator / Helpdesk Administrator

      • Partner Tier1 Support

      • Partner Tier2 Support

   3. Remove permissions where not required

      -> select assignment -> Remove assignment

   4. For roles assigned to groups:

      • Ensure group membership is tightly controlled

      • Avoid broad groups like “All IT”

2. Harden password reset & hybrid flows

   1. Go to Identity -> Protection -> Password reset

   2. Restrict SSPR to specific groups, not all users

   3. Require strong authentication methods for resets

   4. If password write-back is enabled:

      • Ensure only required identities can reset hybrid passwords

      • Regularly review privileged hybrid accounts

Detection

Detect "Reset password" directly in Audit logs.

• Go to Microsoft Entra ID -> Audit logs.

• Filter by Activity: Reset password or Reset user password.

• Filter by Category: UserManagement.

• Review Initiated by (actor) and Target columns.

PowerShell (Microsoft Graph)

Connect-MgGraph -Scopes "AuditLog.Read.All"
Get-MgAuditLogDirectoryAudit -Filter "activityDisplayName eq 'Reset password' or activityDisplayName eq 'Reset user password'" -Top 50 |
    Select ActivityDateTime,ActivityDisplayName,InitiatedBy,TargetResources | Format-Table -AutoSize

UI Logs

References

• https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

• https://learn.microsoft.com/en-us/entra/identity/users/users-reset-password-azure-portal

• https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs