What self-service password reset is — and is not
In Microsoft 365 two paths are easy to mix up:
- Helpdesk or admin reset: someone with the right admin rights sets a temporary password or resets in the Microsoft 365 admin centre. That works, but depends on that person being available — in an SME often the director or one external IT partner.
- Self-service password reset (SSPR): the user proves who they are with previously registered methods (Authenticator app, phone, email or combinations Microsoft allows) and sets a new password themselves, without the helpdesk.
SSPR does not replace MFA. MFA proves who you are at sign-in; SSPR restores access when the password is lost. Both sit side by side. It is also not a licence to keep weak or reused passwords — that still needs a password manager or passkeys.
Why an SME should consider it
Three practical reasons. Continuity: a forgotten password on Sunday evening should not wait until Monday morning with the director. Less privilege pressure: every admin reset is a moment when someone with high rights reaches into an account; fewer of those resets means less risk and less ad-hoc work. Consistency with MFA: if you enforce MFA but still do every reset by hand, you keep a bottleneck users work around (private mail, sticky notes, shared passwords). See also the joiner and leaver checklist: register methods at join; close methods and the account at leave.
Licensing: in Microsoft 365 Business what SSPR fully allows (including changing a password from the portal versus unlock only) depends on licences and whether cloud passwords or hybrid sync are in play. Floor ICT checks that on your tenant before we flip switches — no generic “everything is on by default” promise.
What you should decide in writing
Keep it short enough to decide this quarter:
- who may use SSPR (all standard users, or a pilot group first);
- which authentication methods you allow (Authenticator app preferred; phone or recovery email only if you choose that deliberately);
- minimum number of methods someone must have registered before SSPR works;
- admin accounts: usually excluded from SSPR — reset via a second admin or a fixed break-glass process;
- link to MFA: SSPR methods must not undermine MFA; the same Authenticator app is often the bridge;
- joiner/leaver: enforce method registration at start; revoke account and methods at leave — see the checklist;
- communication: one short staff instruction (where to reset, what they need) before you go live.
Write those points on one page. That is your SSPR policy; the tenant follows that text.
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant we typically: turn SSPR on for the groups you approved; set allowed authentication methods; set the required number of methods; exclude admin roles where you want that; and check whether users have registered methods. We align with existing MFA rules and, where relevant, hybrid password sync. We help with a short user note before go-live.
You still decide: whether SSPR goes on at all; for whom; which methods; whether admins stay excluded; and how you handle exceptions (for example a staff member without a smartphone). Technical switches without those choices lead to “it works for half the organisation and nobody knows why”; policy without execution does not either.
More depth
Checklist for SME directors
1) Confirm MFA is in place for standard users. 2) Decide: SSPR on for whom. 3) Choose allowed methods (Authenticator preferred). 4) Admin accounts: exclude. 5) Let Floor ICT check licences and tenant suitability. 6) Communicate briefly to staff. 7) Tie joiner and leaver to method registration.
Authenticator, phone or email?
The Microsoft Authenticator app is usually the stronger, more practical choice next to MFA. SMS or voice on a phone number is familiar but more sensitive to SIM swap and abuse. A recovery email is useful as a second method, not as the only one. Which combination you allow is a deliberate decision — not “open everything because you can”.
SSPR and admins
Compromise of an admin account through a weak SSPR method is more serious than for a standard user. That is why most SME tenants keep admins outside SSPR and handle reset via a second admin or break-glass. That fits the article on admin accounts.