Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Reset Password and Revoke Sessions [FIX-9003]

This remediation resets a user's password to a randomly generated value, forces the user to set a new password on next sign-in, and revokes all active sign-in sessions and refresh tokens. It is intended as an incident response action when credential compromise is confirmed.

The generated temporary password is not surfaced anywhere, not in logs, ticket details, or the result payload. The intent is pure credential invalidation: the existing password is killed, all active sessions are terminated, and the user must regain access through Self-Service Password Reset (SSPR) or a follow-up reset by the helpdesk.

Rationale

When an attacker has obtained valid credentials — through phishing, credential stuffing, an Adversary-in-the-Middle (AiTM) attack, or token theft — simply revoking sessions is not enough. The attacker still holds working credentials and can sign in again. A password reset combined with session revocation closes both the active-session path and the credential-replay path in a single action.

By not returning the new password to anyone, this remediation avoids leaking a working credential into ticketing systems or operator screens. It also avoids the helpdesk pattern where a temporary password is communicated insecurely. The trade-off is that the user cannot sign in until SSPR is used or a deliberate follow-up reset is performed.

For synced (hybrid) users, cloud password reset is not supported by Microsoft Graph. The remediation detects this via onPremisesSyncEnabled and fails cleanly with a clear message — the password must be reset in on-premises Active Directory.

Fix

An automated fix is available through Attic.

Manual steps:

  1. Navigate to the Entra ID portal at https://entra.microsoft.com
  2. Go to Users > All users
  3. Search for and select the affected user
  4. Click Reset password to generate a temporary password
  5. Click Revoke sessions to sign the user out of all devices
  6. Share the temporary password with the user through a secure channel
  7. The user will be prompted to set a new password on next sign-in

Impact

  • All active sign-in sessions and refresh tokens for the user are invalidated.
  • The user's existing password no longer works.
  • The user cannot sign in until they go through SSPR (if enabled in the tenant) or receive a follow-up password reset from an administrator.
  • For synced users, the action is rejected with a clear message — no partial state is left behind.
  • Password reset on Global Administrators or other highly privileged users requires the caller to hold the Privileged Authentication Administrator role. If the connector identity lacks this role, the action fails with the Graph error returned by Microsoft.

Revert

This action cannot be reverted. The previous password is destroyed and cannot be restored, and revoked refresh tokens cannot be reissued.

Restoring access to the user is a recovery step, not a revert:

  1. If SSPR is enabled, direct the user to https://aka.ms/sspr to set a new password themselves
  2. If SSPR is not available, reset the password again from Entra ID > Users > All users > [user] > Reset password and hand the temporary password over through a secure channel, never by email or chat
  3. The user is prompted to set their own password at next sign-in
  4. For a synced (hybrid) user, reset the password in on-premises Active Directory instead

Check for a rogue authentication method before restoring access. An attacker who still controls a registered MFA method can complete SSPR themselves and set a password of their choosing, handing the account straight back.

More Information