Graph API for Reset the Password for user is not working as expected

Question

Hi Team,

We are attempting to use the Graph API endpoint below, but it’s not behaving as expected.

We sent a PATCH request and received a 200 OK response. However, when the user tries to log in using the updated password, they are able to sign in and are prompted to reset their password.

The issue arises when the user enters their current password and a new one during the reset process — the system consistently returns an error stating that the current password is incorrect.

Thanks,

vidisha

Answer 1

Hello Vidisha!
Thanks for reaching out.
I have reproduced this using this bit of the documentation and was able to successfully send the PATCH request and logged in using the temporary password. I then reset my password and was able to use the new password to log in. The correct response should be a 204
https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#example-3-update-the-passwordprofile-of-a-user-and-reset-their-password
When you use the Graph API to reset a user's password (PATCH /users/{id} with passwordProfile), the new password is set, but by default, forceChangePasswordNextSignIn is often set to true.

When the user signs in, they're prompted to change their password. However, the "current password" the system expects is the one set by the API, not the user's previous password.

If the user enters their old password (before the API reset), it will fail. They must enter the password set by the API as the "current password" in the change password prompt.