⚙️🪟💻CP - Security - SSPR on Lockscreen
Puts the 'I forgot my password' link right on the login screen, so a locked-out user rescues themselves instead of rescuing your morning.
What this policy is about 🔐
A user forgets their password and cannot sign in, so they cannot reach any of the self-service tools that live behind the sign-in. Classic chicken and egg, and it lands on the helpdesk every time. This policy breaks the loop: it adds the Entra Self-Service Password Reset link straight onto the Windows login screen, so the user resets their own password before authenticating and gets themselves back in.
The problem was never that users cannot reset passwords, it is that the reset lived on the wrong side of the locked door. This just moves the door handle to where the locked-out user actually is.
Why this matters 🕵️
Password resets are the number one helpdesk ticket, and almost all of them are avoidable. Every phone-based reset also burns your time and quietly weakens security: a rushed voice call is a weaker identity check than the MFA-backed SSPR flow. Put the link on the login screen and the whole category mostly disappears. Users self-serve at 3 AM on a Sunday without waiting for anyone, the reset goes through proper verification, and your queue stops filling with "I forgot my password again."
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → Authentication.
| Setting | Value |
|---|---|
| Allow AAD Password Reset | Allow |
| Assignment, include | All devices |
| Assignment, exclude | 🛡️🪟💻⛓️Group - Autopilot Devices - IoT 🛡️🪟💻⛓️Group - Autopilot Devices - Kiosk |
Setting it to Allow surfaces the reset link on the login screen. That is the entire policy: one toggle.
Caveats ⚠️
The link is useless if SSPR is off in Entra. This policy only shows the link. For it to do anything, Self-Service Password Reset has to be enabled and scoped in Entra ID, with users registered for it. Ship this to a tenant where SSPR is not configured and you have added a button that leads nowhere, which generates the exact tickets you were trying to remove. Verify SSPR in Entra password reset settings first.
Excluded device types have no user to reset. IoT and Kiosk endpoints run shared or headless experiences without individual user logins, so SSPR does not apply. They are excluded to keep the profile tidy.
License and reversibility. Included in Business Premium. Clean-revert: unassign and the link falls away on the next policy refresh.
🔗 Related
- ⚙️🪟💻CP - Security - Config Refresh: keeps policy like this one reapplying so a drifted device does not quietly lose it.
The only winning move is the ticket that never gets created. Put the reset where the locked-out user already is. 🔐