Resetting a user's password in Microsoft 365

How to reset a Microsoft 365 user's password from the admin center — whether they're locked out or just need a fresh start.

If a team member has forgotten their password or is locked out of their account, you can reset it for them in a few clicks from the Microsoft 365 admin center. You can also let users reset their own passwords if you enable that feature.

Quick summary

In the admin center, go to Users → Active users, select the person, and choose Reset password. You can auto-generate a password or set one manually. The admin center no longer emails passwords, so print the account details to a PDF or pass them on another secure way. They will be prompted to change it when they next sign in.

What you'll need

Admin access to the Microsoft 365 admin center — resetting passwords needs the Password Administrator role
A secure way to get the new password to the user (not in the same email they use to log in — they can't access it yet)

Resetting a password as an admin

Sign in to the admin center at admin.microsoft.com.

Go to Users → Active users.

Select the user in the list.

Select Reset password.

Choose how to set the new password. You can let Microsoft auto-generate one, or create one for them.

Leave the option to require a password change at next sign-in switched on, if the page offers it. It means only they will know their final password.

Select Reset password. Microsoft shows you the new password, and offers to print the account details to a PDF.

Get the temporary password to them securely — print the details to a PDF and hand them over, or use a phone call, text message, or secure messaging app. Don't send it to the email address they need to log in to.

The admin center won't email a password for you

Microsoft removed that option on 30 August 2024. The recommended route now is to print the account information to a PDF file and share that securely.

Done

The user can now sign in with the temporary password. If a password change at next sign-in was required, they'll be prompted to set a permanent one straight away.

Letting users reset their own passwords

You can configure Microsoft 365 to allow users to reset their own passwords without admin help. This is called self-service password reset (SSPR).

To enable it:

In the admin center, go to Settings → Org settings, then open the Security & privacy tab.

Select Self-service password reset, then select the option to go and turn it on. This hands you over to the Password reset page in the Microsoft Entra admin center — the identity settings live there, not in the Microsoft 365 admin center.

On the Properties page, set Self service password reset enabled to All, or to Selected and pick a group. Then select Save.

Ask users to register a verification method. They have to register their contact details — such as a phone number or an alternate email address — before they can reset anything.

Which plans include it

Microsoft's licensing page says basic self-service password reset is available in Microsoft 365 Business Standard or higher, and in Microsoft Entra ID P1 or P2. The Microsoft 365 admin documentation puts it more broadly, as included with any paid business, education, or nonprofit plan, and adds that it doesn't work on a Microsoft 365 trial. Both agree that writing a new password back to an on-premises Active Directory needs a higher plan — Business Premium, or Microsoft Entra ID P1 or P2. If you're on Business Basic, check whether the option is there before you promise it to your team.

Common questions

A user is completely locked out. Can they still reset their own password?

Only if self-service password reset is enabled and they previously registered a verification method (phone number or recovery email). If they haven't, an admin will need to reset it for them.

I'm the only admin and I've forgotten my own password. What do I do?

If you registered an alternate email address or mobile number on the account, sign out, type your user name, select Next, and then select Forgot password — the wizard uses that contact information to verify you. If you never added it, Microsoft's remaining advice is to contact Microsoft support. In the admin center that's Help & support at the bottom right, and then the Contact Support (headset) icon; see Get support for Microsoft 365 for business. Microsoft's support phone numbers have changed, so use the number on their own country list rather than one you have written down.

How do I make sure users choose strong passwords?

You can't set your own length or complexity rules for cloud-only accounts. Microsoft's words: cloud-only accounts "have a predefined password policy that can't be changed", and the only things you can change are how many days until a password expires and whether it expires at all (under Settings → Org settings → Security & privacy → Password expiration policy). So the work is in what you ask of people: teach the team what a good passphrase looks like, encourage a password manager, and see strong passwords for the length we recommend.

Should I force password changes regularly?

No. Microsoft's latest guidance discourages password expiration for cloud-only accounts, and the recommended setting is for passwords never to expire. Microsoft's own explanation is that almost every rule you impose weakens password quality, because people normalise around it. Turn on multi-factor authentication instead — it protects accounts far better than a change schedule.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.