Question

Your company uses Microsoft Entra ID synchronized from an on-premises Active Directory via Microsoft Entra Connect. You enable self-service password reset (SSPR) for all users. Users report that when they reset their password in the cloud, they can no longer sign in to on-premises domain-joined computers with the new password. You need to ensure that password changes made through SSPR are also applied to the on-premises Active Directory. What should you do?

Accepted Answer

Enable password writeback in Microsoft Entra Connect and grant the connector account the required Reset Password permissions in Active Directory.

Answer

Configure a Conditional Access policy that requires multifactor authentication for password reset.

Answer

Increase the number of authentication methods required for SSPR from one to two.

Answer

Change the SSPR scope from 'All' to 'Selected' and add only cloud-only users.