How I Turned Password Resets From a Nightmare Into a Win
“Hi IT, I forgot my password. Can you reset it?”
If you work in IT, you’ve probably seen this message dozens, if not hundreds, of times.
At first, it seems minor. But behind every password reset lies a productivity drain, frustrated users, and potential security risks.
Get Nelson Njuguna’s stories in your inbox
Join Medium for free to get updates from this writer.
I decided to tackle this head-on using Microsoft Entra ID, Self-Service Password Reset (SSPR), and Multi-Factor Authentication (MFA) — while keeping the process smooth and user-friendly.
Step 1: User Onboarding and SSPR Attempt
A new user was created in Entra ID. They attempted a self-service password reset but were denied because they hadn’t registered for SSPR yet.
This showed me immediately that onboarding users for self-service workflows is critical — otherwise, friction and frustration appear before the user even logs in.
Step 2: Admin-Initiated Password Reset
As an admin, I logged into Microsoft Entra ID and selected the affected user account. I initiated a manual password reset, generating a default temporary password.
Step 3: Secure Password Handoff via Manager
Instead of sending the default password directly to the user, the temporary password was securely shared with the user’s manager.
The manager then relayed the credentials to the user, creating an extra layer of security for sensitive information.
Step 4: User Login and Password Update
The user logged in using the default password and immediately updated it to a secure, personal password.
Step 5: MFA Registration
After updating the password, the user registered for Multi-Factor Authentication (MFA), adding a second layer of security.
The result: secure, frictionless account access, and a user who could now safely self-manage their credentials in the future.
Step 6: Auditing & Verification
To ensure accountability and compliance, all actions were logged and reviewed:
- Password reset events recorded in Entra ID audit logs
- Manager handoff confirmed and timestamped
- MFA registration verified
Auditing ensures you have a traceable, verifiable workflow, which is critical for security audits, regulatory compliance, and incident response.
The Hard Truth About Password Resets
Many organizations treat password resets like a minor nuisance. Here’s why that’s dangerous:
- Manual resets waste IT hours
- Frustrated users may take insecure shortcuts
- Delays create stress and inefficiency
SSPR + MFA isn’t optional. It’s critical to modern identity management.
Step 6: Lessons Learned
- Security Must Be User-Friendly — Users will bypass complicated processes.
- Test Edge Cases — Unregistered users highlight gaps in workflow.
- Secure Handoff Matters — Sharing default passwords via managers reduces risk.
- SSPR + MFA = Zero Trust Foundation — Every login verified, every user empowered.
The Bigger Picture: Zero Trust Identity Management
This workflow is just one piece of a broader Zero Trust approach:
- Enforce device compliance and location-based access
- Apply risk-based authentication for suspicious logins
- Automate governance and access reviews
When done right, password resets stop being a headache — they become a productivity booster and a security win.
Final Thoughts
Sometimes the smallest workflows reveal the biggest gaps. By implementing SSPR, MFA, and secure password handoff in Microsoft Entra ID, I reduced friction, strengthened security, and improved the user experience.
Password resets aren’t just an IT chore — they’re a chance to make security simple, smart, and user-friendly.
Curious to see the full lab setup, with screenshots and workflow diagrams? Drop a comment — I’ll share the step-by-step guide.
#MicrosoftEntra #SSPR #MFA #IAM #CyberSecurity #ZeroTrust #UserExperience #ITLife
