How to Enable Entra Password Reset on Windows via Intune

Enabling password reset functionality through Entra ID (formerly Azure AD) on Windows devices provides a seamless way for users to regain access without contacting IT support. This is especially useful for enterprises that leverage Microsoft Intune for device management and security. In this guide, we’ll walk you through the process of enabling Entra password reset on Windows lock screens using Intune.

What is Entra Self-Service Password Reset (SSPR)?

Self-Service Password Reset (SSPR) allows users to reset their passwords independently by verifying their identity using pre-configured authentication methods. This reduces IT overhead, improves user productivity, and enhances the overall security posture.

When integrated with Intune, SSPR can be made accessible directly from the Windows lock screen, offering a user-friendly and secure recovery option.

Why Enable Password Reset via Intune?

• Improved User Experience: Users can reset their passwords without involving IT, even from the lock screen.
• Reduced Help Desk Calls: Eliminate one of the most common IT support requests.
• Enhanced Security: Secure identity verification through multi-factor authentication (MFA).
• Centralized Management: Simplified configuration and deployment through Intune.

Steps to Enable Entra Password Reset in Windows Using Intune

1. Enable Self-Service Password Reset in Entra ID

Before configuring Intune, you need to enable SSPR in Entra ID.

Steps:

1. Sign in to Microsoft Entra Admin Center:
   Visit the Microsoft Entra Admin Center.
2. Navigate to Password Reset Settings:
   • Go to Password reset > Properties.
   • Set Self-service password reset enabled to Yes.
   • Choose the scope: either All users or specific groups.
3. Configure Authentication Methods:
   • Define methods users can use to verify their identity (e.g., email, SMS, app notification).
   • Save your changes.

2. Configure Intune to Enable Password Reset on Lock Screens

Next, configure a device profile in Intune to enable the password reset option on Windows lock screens.

Steps:

1. Sign in to Intune Admin Center:
   Access Microsoft Intune Admin Center.
2. Create a Configuration Profile:
   • Navigate to Devices > Configuration profiles.
   • Click + Create profile.
   • Set Platform to Windows 10 and later.
   • Choose Settings Catalog as the profile type and click Create.
3. Add the Required Setting:
   • Name your profile (e.g., "Enable Lock Screen SSPR").
   • In the Settings Catalog, search for "Allow password reset".
   • Enable the "Allow password reset on the lock screen" option.
4. Assign the Profile to Devices:
   • Under Assignments, select the groups or devices that require this feature.
   • Save and deploy the profile.

3. Validate the Configuration

After deploying the configuration, ensure it works as intended.

On a Windows Device:

1. Lock the Screen:
   Use Windows + L to lock the device.
2. Verify Password Reset Option:
   On the lock screen, look for the "I forgot my password" option. Selecting it should guide the user through the password reset process.

Monitoring and Troubleshooting

In Intune:

• Check deployment status under Devices > Monitor > Configuration Profiles.
• Ensure the profile is applied to the intended devices.

In Entra ID:

• Go to Password reset > Usage & Insights to monitor password reset activity and identify any potential issues.

Best Practices for SSPR in Intune

• Enable Multi-Factor Authentication (MFA): Strengthen security by requiring MFA during password resets.
• Educate Users: Inform users about the new password reset option and how to use it.
• Test Configuration: Test the setup on a small group of devices before rolling it out organization-wide.
• Review Licensing Requirements: Ensure users have the necessary Azure AD Premium P1 or P2 licenses for SSPR.

Benefits of Integrating Entra SSPR with Intune

1. Increased Efficiency: Automates the password reset process, reducing support ticket volumes.
2. Enhanced Security: Protects against unauthorized access with secure identity verification.
3. Seamless Experience: Direct lock screen integration improves accessibility for end users.
4. Centralized Management: Streamlines IT operations by managing everything from Intune.

Conclusion

Enabling Entra password reset on Windows devices via Intune is a critical step in modernizing your IT infrastructure. It simplifies password recovery for users while enhancing security and reducing IT workloads. By following the steps outlined above, you can ensure a smooth and efficient implementation for your organization.