I am the owner and global administrator of our Azure account. I am unable to reset users passwords and get presented with the error: We're sorry, we're not able to reset this user's password right now. This may be due to temporary issues on our end. Please wait a few minutes and try again. I have waited several days and confirmed that the same error is showing for other administrators. Please could someone suggest that we could be checking?

@Mark Kenna Thanks for your time on our offline sync. After doing several testing internally, we found that the Identity issuer turns to Phone when we enable the Password less authentication feature to enable user sign in process via SMS which is termed as SMS based sign-in. We also learned that this has nothing to do with the guest/external users. If the user is enabled for this, the Identity authority expects the sign in via SMS codes and not via passwords. Due to this reason AAD does not let any admin to reset the password of the user considering the password are not used anyway as user has been onboarded for Password Less Authentication. Thus the behavior you see is expected. We really encourage customers to move away from passwords and these methods certainly help you achieve the same. Feel free to reach out to us for any queries and we will do our best to help you. ----------------------------------------------------------------------------------------------------------------- If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.

Are these users cloud accounts or are the user synced from on-premise? If they are from on-premise, I would look at the Azure AD Connect settings and make sure those are set right. Also look at the unsupported writeback operations and make sure you are not trying to reset the password by one of these ways: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback#unsupported-writeback-operations

Azure AD Password Reset Error

Accepted answer

VipulSparsh-MSFT 16,271 Reputation points Microsoft Employee

2021-06-16T11:25:50.003+00:00

@Mark Kenna Thanks for your time on our offline sync. After doing several testing internally, we found that the Identity issuer turns to Phone when we enable the Password less authentication feature to enable user sign in process via SMS which is termed as SMS based sign-in.

We also learned that this has nothing to do with the guest/external users.

If the user is enabled for this, the Identity authority expects the sign in via SMS codes and not via passwords. Due to this reason AAD does not let any admin to reset the password of the user considering the password are not used anyway as user has been onboarded for Password Less Authentication.

Thus the behavior you see is expected. We really encourage customers to move away from passwords and these methods certainly help you achieve the same.
Feel free to reach out to us for any queries and we will do our best to help you.

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.
Please sign in to rate this answer.

2 people found this answer helpful.
VipulSparsh-MSFT 16,271 Reputation points Microsoft Employee

2021-06-08T12:46:14.153+00:00

@Mark Kenna Thanks for reaching out.

In order for us to help you, we need to understand few things :
1) Were you able to reset the users password in past ? Or this has never worked.
2) Are you connected to corp network via VPn and then trying this ? Has someone tried open internet to see if there are any network level block ?
(Many a times the corporate firewall block certain URLS required for password rest to work correctly)
Do make sure that your network allow this :
*.microsoftonline.com (80 & 443)
*.windows.net (80 & 443)
*.adhybridhealth.azure.com (443)
policykeyservice.dc.ad.msft.net (443)
secure.aadcdn.microsoftonline-p.com (443)
3) If changing network also does not help, you will have to follow this and provide all those details.

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.

Mark Kenna 21 Reputation points

2021-06-08T15:48:16.76+00:00

Thanks for your reply. Answers inline:

Were you able to reset the users password in past ? Or this has never worked.
-I have always been able to reset passwords

Are you connected to corp network via VPn and then trying this
-No. We are simply trying to reset a standard users password via the Azure users page

If changing network also does not help, you will have to follow this and provide all those details.
-This worked fine. I could reset my own password using this link

VipulSparsh-MSFT 16,271 Reputation points Microsoft Employee

2021-06-09T05:16:44.127+00:00

@Mark Kenna You need to check in the audit logs about any error code it might be throwing, It should reveal something under status reason. Here is a snap :

Mark Kenna 21 Reputation points

2021-06-09T10:22:30.5+00:00

I have checked the audit logs - there is nothing whatsoever showing in the logs at the time of the action. This was the first thing I checked.

Mark Kenna 21 Reputation points

2021-06-09T12:46:52.427+00:00

The one thing I have noticed is that I am able to reset the passwords with anyone that has an onmicrosoft.com identity issuer. If anyone has "phone" then I get the error.

Matt Maher 101 Reputation points

2021-06-09T20:07:14.013+00:00

That's interesting. So it doesn't sound like a permission issue if you can change some but not others. I don't know much about the Sync process AAD -> AAD DS, but I wonder if something is not setup right, like Password Writeback, and the error you see is just the generic one. Do you see anything under AAD Connect in AAD? Apologies, but I am not 100% sure how Azure AD syncs with AAD DS, but if you can change onmicrosoft.com accounts it seems the issue maybe caused by a sync.

Mark Kenna 21 Reputation points

2021-06-10T08:03:32.573+00:00

We don't have an on-prem domain so we don't use AD connect.

VipulSparsh-MSFT 16,271 Reputation points Microsoft Employee

2021-06-11T04:51:08.957+00:00

@Mark Kenna If you are able to reset the password for .onmicrosoft.com users and not for others, it does seems like you had some on-prem existence at some point of time and somehow the Azure AD service might still believe that. Can you share the screenshot for the user for whom you are not able to reset the password and user for whom you are able to. :

Mark Kenna 21 Reputation points

2021-06-11T08:14:14.257+00:00

Here is a screenshot showing a user that I can, and a set of users that I cannot reset. The tick and crosses indicate which is which.

Thanks!

Matt Maher 101 Reputation points

2021-06-12T13:10:31.32+00:00

"Phone" as the issuer means that this account is federated, it doesn't belong to your AzureAD tenant. That would make sense that you cannot reset a password to an account that is outside your AAD. But why do your users show up as Phone instead of onmicrosoft.com? If you click on the issuer "phone" do you see multiple issuers?

Mark Kenna 21 Reputation points

2021-06-14T08:43:42.9+00:00

I do indeed see multiple identities. We recently setup AADDS. The directory is showing as not sync'd.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure AD Password Reset Error

1 additional answer

Your answer