AAD-admin PTA/PHS/federated user SSPR

Question

Hello,

I have one quick tech point to confirm.

We know PTA/PHS/federated user can reset their password through SSPR-portal and the new password will be written-back to on-prem-AD

Can AAD-admin do the same work for the PTA/PHS/federated end-user so that the new temporary password with "Force Change Password on Next Logon" flag goes to on-prem-AD ?
If not, is it because the feature is not yet in OR my ask is not technically correct.

Thanks.

Answer 1

Hi @testuser7-8288,

Yes, Administrator can reset the password of end user from Azure AD Portal and that will be written back to On-premises Active Directory as well. This will also select the "User must change password at next logon" in properties of the user account in On-premises AD.

However, if you have selected "Password never expire" checkbox for the user, in that case "User must change password at next logon" won't get selected.

Administrators can also use below graph call for this purpose:

Call: POST https://graph.microsoft.com/beta/users/user's_object_id/authentication/passwordMethods/password_method_id/resetPassword
Body: {"newPassword":"P@$$w0rd","forceChangePasswordNextSignIn":true}

You can get password_method_id by using below call:

GET https://graph.microsoft.com/beta/users/user's_object_id/authentication/passwordMethods

Read more about these graph calls here: https://learn.microsoft.com/en-us/graph/api/passwordauthenticationmethod-resetpassword?view=graph-rest-beta&tabs=http

---

Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.

Answer 2

Hi @testuser7-8288,

Here are the supported writeback operations.

Hopefully it helps you.

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback#supported-writeback-operations

Answer 3

Thanks \[@\](/users/na/?userId=cf814690-8d1d-4b51-a222-2588cf06ba43) and [@](/users/na/?userId=c6ae2d77-a6ea-4455-b13d-7a5d0bde00ae)
It helps.