Self service password reset enabled - Cannot change group

Question

Self service password reset enabled - Cannot change group

Leo Pickford 10

Hello,

I have a 'selected' group saved and the configuration works. But when I choose a new group, save settings the group reverts back to it's original setting.

What am I missing?

Have tried private browsing, different admin account, checked AD sync settings etc but nothing seems to work.

Have P1 Entra subscription and using Hybrid AD Sync.

Thank you, Leo.

Ivo Mayer 10 Reputation points

2024-03-07T13:39:10.77+00:00

We have the same issue!

3 answers

Your answer

Ivo Mayer 10 Reputation points

2024-03-07T13:39:10.77+00:00

We have the same issue!

Answer 1

Sandeep G-MSFT 20,906 Microsoft Employee Moderator

@Leo Pickford

Thank you for posting this in Microsoft Q&A.

Currently this is a known behavior. As part of SSPR configuration you can only enable one Microsoft Entra group for SSPR using the Microsoft Entra admin center. As part of a wider deployment of SSPR, Microsoft Entra ID supports nested groups. User's image

However, as mentioned above SSPR configuration supports nested groups. This means you can make the 2nd group as part of first group so that even second group will be configured for SSPR.

You can refer below public article for this,

https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr

If you are looking for functionality to add second group separately then you can submit feedback in Azure feedback portal.

https://feedback.azure.com/d365community/forum/22920db1-ad25-ec11-b6e6-000d3a4f0789

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Leo Pickford 10 Reputation points

2024-03-08T10:05:29.24+00:00

Hello Sandeep,

Thanks for the message.

I wish to replace the group not add a second group.

For context, I have attempted various ways to remove the old group and replace with a new group.

SSPR was setup years ago I'm trying to modify a legacy configuration.

For example, I deleted the original group 'everyone' (a distribution group AD Connect from Active Directory on-Prem) and saved. Waited 24Hrs. Choose select group 'Entra ID' and save. Refresh the page and the original group 'everyone' is present e.g. the original group cannot be changed.

Is this something to do with Group Write back?

Or something to do with Authentication policies?

Thanks, Leo
Ivo Mayer 10 Reputation points

2024-03-08T10:11:25.17+00:00

@Sandeep G-MSFT

Hi Sandeep, issues in not in nesting or adding, but changing the group. We need to change it with a new one. The Gui permits to change and save it, but refreshing the page it turns back to the old group.

Thank you

Answer 2

Leo Pickford 10

Yeh same result unfortunately.

Leo Pickford 10 Reputation points

2024-03-07T13:43:44.7133333+00:00

I think the problem is 'group writeback' on AD Connect.

Talked to expert today and they suggested this which I'm looking at now. I don't have group write back enabled...

The change in AD Connect is just a tick box but you need to specify which OU for destination so checking that before I break AD...
Ivo Mayer 10 Reputation points

2024-03-07T14:32:08.5466667+00:00

H Leo, I don't see the connection between these two settings, however I tried just few minutes ago without success. We had the same settings (no groups writeback). I enabled it but it doesn't work unfortunately! Weird indeed! I tried in two different tenant, same result. Thank you

Answer 3

Ivo Mayer 10

It could be related to the change of the Authentication methods...(?)

Maybe a bug or a limit due to the next generation of troubles :)

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-manage#legacy-mfa-and-sspr-policies

Leo Pickford 10 Reputation points

2024-03-07T16:58:17.21+00:00

Interesting. Thanks for sharing.

Where are you with: Authentication methods | Policies | Migration?

Looks like I'm at pre-migration...
Ivo Mayer 10 Reputation points

2024-03-12T14:33:34.0433333+00:00

Same stage at the moment. I need to investigate about the migration steps.
Leo Pickford 10 Reputation points

2024-03-18T17:51:48.0733333+00:00

Hi Ivo, SSPR group selection seems to be working now. I can select group, save, refresh and the new group remains. No errors.

Before migrating authentication settings I did notice the new group for SSRP was selected. I don't understand why. Perhaps a glitch after several attempts or perhaps a change from (authentication migration) pre-migration to in-migration.

I have just completed authentication migration, now complete. I am holding my breath if Users will all be prompted for re-authentication... (not so far...)

It seems logical to assume that 'authentication migration' was causing this SSPR group selection problem.

All the best,

Leo.
Ivo Mayer 10 Reputation points

2024-03-18T18:51:16.4966667+00:00

Hi Leo,

Thank you so much for your message! I'll see if my configuration will be lucky as your!

Hold the breath is our mantra! :)

All the best!

Ivo

Share via

Self service password reset enabled - Cannot change group

3 answers

Your answer