Control: 1.1.4 Ensure self-service password reset is enabled

Description

Enabling self-service password reset allows users to reset their own passwords in Azure AD. When your users sign in to Microsoft 365, they will be prompted to enter additional contact information that will help them reset their password in the future. If combined registration is enabled additional information, outside of multi-factor, will not be needed. As of August 2020 combined registration is enabled by default.

Users will no longer need to engage the helpdesk for password resets, and the password reset mechanism will automatically block common, easily guessable passwords. Combined registration should be enabled if not already, as of August of 2020 combined registration is automatic for new tenants therefor users will not need to register for password reset separately from multi-factor authentication.

Remediation

To enable self-service password reset, use the Microsoft 365 Admin Center:

1. Under Admin centers choose Azure Active Directory.
2. Choose Users from the left hand navigation.
3. Choose Password reset.
4. On the Properties page, select All under Self service password reset enabled.
5. Select Save.