SSPR password writeback issue - not reaching connector - not even a mention of failures in Entra audit logs - SSPR_0030 error on user end

Question

SSPR password writeback issue - not reaching connector - not even a mention of failures in Entra audit logs - SSPR_0030 error on user end

Justin Dowswell 0

Hey there,

Got a frustrating issue where everything in my Hybrid AD setup seems to be set up correctly, but SSPR refuses to work.

SSPR reset for all user fails at the set-password/writeback stage with "connectivity problems," after username and verification succeed, but before new password entry. I have Password Reset on a scope of All users.

Affects both adminCount=1 and adminCount=0 users.

Connector account has correct writeback ACLs (reset/change/lockoutTime/pwdLastSet, inheriting), inheritance confirmed on the user object (AreAccessRulesProtected = False), user synced, not locked, not protected.

Writeback reports healthy (event 31042, live heartbeats to fra-1/sea-1), users' exports succeed.

The reset produces no export error in the Sync Service Manager and no clear SSPR audit log entry - the request isn't reaching the connector despite a healthy channel.

Also confirmed these:

TLS 1.2, network connectivity, .NET >4.8 all good
tested 443 outbound access - all good
the Self-service Password Management log is empty even after testing SSPR (and it failing)
users are eligible for SSPR writeback
AD DS connector account is fine (other services like Windows Hello are working fine)
just did another reset 14:15 AEST with the same SSPR_0030 error with no entry in the Entra audit logs so no event ID

It looks like I am at the end of my tether of what telemetry I can see.

Thanks in advance,
Justin

Justin Dowswell 0 Reputation points

2026-07-08T05:47:07.0233333+00:00

I have also followed all the suggested steps here, including disabling and re-enabling the password writeback feature: https://learn.microsoft.com/en-us/entra/identity/authentication/troubleshoot-sspr-writeback
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Justin Dowswell 0 Reputation points

2026-07-09T01:53:04.2533333+00:00

Double checked all licenses, they have P1 via 365 Business Premium. Though this is only a recent issue, and if I remember correctly SSPR previously worked with my Business Standard users. The connector account also has a P1 license.

Yes - the Entra ID Connect Sync Server has enough memory.

Answer recommended by moderator

0 additional answers

Your answer

Justin Dowswell 0 Reputation points

2026-07-08T05:47:07.0233333+00:00

I have also followed all the suggested steps here, including disabling and re-enabling the password writeback feature: https://learn.microsoft.com/en-us/entra/identity/authentication/troubleshoot-sspr-writeback
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Justin Dowswell 0 Reputation points

2026-07-09T01:53:04.2533333+00:00

Double checked all licenses, they have P1 via 365 Business Premium. Though this is only a recent issue, and if I remember correctly SSPR previously worked with my Business Standard users. The connector account also has a P1 license.

Yes - the Entra ID Connect Sync Server has enough memory.

Answer 1

Justin Dowswell 0

Make sure to uncheck Write back passwords with Microsoft Entra Connect cloud sync even though it is checked by default even if you do not have Cloud Sync set up and are using Microsoft Entra Connect Sync. Found an autoupdate entry in my event log that apppears to have flipped these settings back to default.

0 comments