How to resolve AADSTS900144: The request body must contain the following parameter: 'client_id'. error on clicking forgot password

Question

How to resolve AADSTS900144: The request body must contain the following parameter: 'client_id'. error on clicking forgot password

Boddipudi, Vijaya (contractor) 0

While trying to forgot password link we are redirecting to https://icgssodev.ciamlogin.com/icgssodev.onmicrosoft.com/oauth2/v2.0/authorize?username=xxxx.com with error message
Request Id: 9c5a0f35-fd73-4d4f-8e5a-08774a620200

Message: AADSTS900144: The request body must contain the following parameter: 'client_id'.

1 answer

Your answer

Answer 1

Rukmini 11,470 Microsoft External Staff Moderator

Hello Boddipudi, Vijaya (contractor),

To reset password in Microsoft External ID tenant, you have to enable self-service password reset flow.

Users can update or reset their passwords with Microsoft Entra External ID's self-service password reset (SSPR) feature without the assistance of an administrator or help desk. Users can follow instructions to unblock themselves and resume work if their account is locked or they forget their password.

Refer this Microsoft Document: Enable self-service password reset - Microsoft Entra External ID | Microsoft

Otherwise, you can also make use of native authentication in Entra External ID to run the SSPR flow for a user with email and OTP. Refer this blog.

The Global Admin also can reset the password, by going to Azure Portal -> Users -> Select user -> Reset password.

If the resolution was helpful, kindly take a moment to accept the answer and upvote it 👍 it as a token of appreciation.

Rukmini 11,470 Reputation points Microsoft External Staff Moderator

2025-11-18T12:03:37.57+00:00

Hello Boddipudi, Vijaya (contractor), If the resolution was helpful, kindly take a moment to accept the answer and upvote it 👍 it as a token of appreciation.
Boddipudi, Vijaya (contractor) 0 Reputation points

2025-11-18T14:00:21.93+00:00

Hello Rukmini,

Thanks for sharing those details. Just to clarify our position: we don’t plan to enable self-service password reset (SSPR) for guest users in our Entra tenant. Guest accounts always authenticate against their home directory (the tenant or identity provider they originate from), so password resets must be managed there.

For guests:

Password reset is handled by their home tenant’s Azure AD or identity provider.

If they forget their password, they should use the standard Microsoft password reset portal (https://passwordreset.microsoftonline.com) or contact their own administrator.

Global Admins in our tenant cannot reset guest passwords, since we don’t own their credentials.

We are expecting how to configure our application to enable forgot password link to carry client_id to redirect to https://passwordreset.microsoftonline.com with out breaking the application with AADSTS900144: The request body must contain the following parameter: 'client_id'.error
Rukmini 11,470 Reputation points Microsoft External Staff Moderator

2025-11-18T14:28:31.6866667+00:00
Hello Boddipudi, Vijaya (contractor),

A client_id cannot be sent to the Microsoft password reset webpage due to: There is no OAuth endpoint at https://passwordreset.microsoftonline.com.

Client_id, redirect_uri, and response_type are not accepted.

Azure will return AADSTS900144 (missing parameters) if you attempt to call the Azure AD /authorize endpoint to attach a client_id.

Password resets for users must take place in their home tenancy, not within your app.

Hence check the below:

The "Forgot Password" link in your application should just take you to: https://passwordreset.microsoftonline.com/?username=xxx

Absence of client_id Absence of OAuth No app rerouting No policy requiring password resets This prevents AADSTS900144 and is the only guest account method that is supported.
Rukmini 11,470 Reputation points Microsoft External Staff Moderator

2025-11-19T12:28:04.5333333+00:00

Hello Boddipudi, Vijaya (contractor), Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Boddipudi, Vijaya (contractor) 0 Reputation points

2025-11-19T14:19:39.7033333+00:00

Thank you for the detailed explanation. However, this does not seem to be a feasible solution in my case. The option you are referring to does not exist anywhere in the current Azure Entra ID portal or configuration screens. There is no setting or mechanism in Entra ID that allows us to route “Forgot Password” traffic directly to https://passwordreset.microsoftonline.com/?username=xxx for guest users from within an application.

In the latest Entra ID interface, I’m not finding any place where this behavior can be configured, nor any supported method to generate or prefill the username parameter in a compliant way for guest accounts. Because of this, the recommended approach cannot be implemented using the current Entra experience.

If there is an updated Entra path or documentation link that reflects this capability, please share it — otherwise this approach does not appear to be supported in the new Entra portal.
Rukmini 11,470 Reputation points Microsoft External Staff Moderator

2025-11-20T12:04:27.68+00:00

Boddipudi, Vijaya (contractor),

You're correct; Entra ID does not allow you to build up a "Forgot Password" flow for visitors that either prefills their username from within your tenancy or reroutes them to passwordreset.microsoftonline.com. Entra does not support this behavior for guests accounts.

The "Forgot Password" link must be created in your own application code and point to: https://passwordreset.microsoftonline.com/? username =
Boddipudi, Vijaya (contractor) 0 Reputation points

2025-11-21T08:20:14.61+00:00

Hi Rukmini,

Thanks for the clarification.

I understand that Entra ID does not allow customizing the built-in “Forgot Password” link on the default Enter Password page, and that the only supported approach is to implement the “Forgot Password” link within our own application and redirect users to:

https://passwordreset.microsoftonline.com/?username=<user email>

However, our requirement is specifically about customizing or overriding the Forgot Password link on the Azure Entra generated login/password page itself, not inside our application UI. We wanted to check if there was any supported way—policy, branding option, custom page, query param, or B2C-like customization—that would let us:

Change where the built-in “Forgot Password” link navigates, OR

Hide it entirely and replace it, OR

Pre-fill the username in that page so users don't have to type it again.

Based on your response, I want to reconfirm that none of these are possible in Entra ID for guest users or internal users, and that the built-in password reset link cannot be modified or extended in any form.

Please confirm if this understanding is accurate, so we can plan our application flow accordingly.

Thanks, Vijay
Rukmini 11,470 Reputation points Microsoft External Staff Moderator

2025-11-21T09:09:09.8366667+00:00

Boddipudi, Vijaya (contractor) You are Right! The built-in "Forgot Password" feature on the Azure Entra login/password page for internal or guest users cannot be altered, hidden, replaced, or pre-filled. Implementing a "Forgot Password" link in your own application and rerouting users to: is the only supported method. https://passwordreset.microsoftonline.com/?username=

The built-in link cannot be overridden by any policy, branding option, query parameter, other standard Entra customization.
Boddipudi, Vijaya (contractor) 0 Reputation points

2025-11-21T14:17:21.2233333+00:00

Thank you, Rukmini, for confirming this and for taking the time to validate all the possibilities.

I appreciate the detailed clarification that the built-in “Forgot Password” link on the Azure Entra sign-in page cannot be customized, prefilled, or overridden through any policy, branding configuration, or query parameters. Your explanation helped confirm that implementing our own “Forgot Password” link within the application—redirecting users to https://passwordreset.microsoftonline.com/?username= —is the only supported approach for both internal and guest users.

Thanks again for your support and guidance!
Rukmini 11,470 Reputation points Microsoft External Staff Moderator

2025-11-21T14:18:29.1433333+00:00

Boddipudi, Vijaya (contractor) If the resolution was helpful, kindly take a moment to accept the answer and upvote it 👍 it as a token of appreciation.

Share via

How to resolve AADSTS900144: The request body must contain the following parameter: 'client_id'. error on clicking forgot password

1 answer

Your answer