Microsoft Entra: Change a Password Without an Active Password

Introduction

Microsoft Entra ID (formerly Azure AD) introduces a new feature allowing users without an active password to set a new one directly via My Sign-Ins. This advancement targets organizations adopting modern authentication methods while continuing to use applications requiring a password.

This capability will be available from October 2026 and will apply to the entire tenant once enabled. Let's review the details, implications, and essential steps to prepare yourself.

Purpose of This New Feature

Passwordless systems are becoming mainstream thanks to technologies such as Windows Hello for Business or FIDO2 security keys. However, certain legacy applications or service accounts still require a password, leaving users in uncomfortable situations when they forget it.

Currently, to create a new password:

• The user must remember the old one.
• Or use the self-service password reset (SSPR) feature.

If a user has not registered for SSPR before switching to a passwordless solution, troubleshooting often ends with a call to IT support. By allowing a user authenticated via a modern auth method to create a password without having to go through SSPR, Microsoft seeks to reduce this type of helpdesk requests.

Details and Timeline

This feature will enter general availability (GA) at the end of October 2026. The initial deployment will also include GCC environments. Note:

• Disabled by default: the administrator must manually enable the feature.
• Once enabled, it will apply to all eligible users in the tenant.
• Administration controls, as well as associated APIs, will be available at launch.
• Official documentation on Microsoft Learn will be published in parallel.

What Doesn't Change

This evolution does not replace passwords in scenarios where they are necessary. It aims only to simplify their management for passwordless users encountering a occasional need.

How It Works: Password Change Without SSPR

An eligible user can now, via My Sign-Ins, click on the Change password option. To validate this operation, they will need to authenticate with:

• A FIDO2 security key,
• A Windows Hello for Business method,
• Or a passkey.

Once identity is verified, it will be possible to create a new password without having to provide the old one. Microsoft describes these authentication methods as phishing-resistant, which enhances their security.

How Many Users Are Affected?

Before enabling this option, it is crucial to assess how many of your current users find themselves in this hybrid situation: passwordless authentication but occasional need for a password.

To do this, use a PowerShell script to generate an interactive report of authentication methods in your tenant. A typical example might include this type of command:

1# Example: report on Entra ID authentication methods
2Connect-AzureAD
3Get-AzureADUserAuthenticationMethod | Export-CSV -Path "EntraAuthReport.csv" -NoTypeInformation

The enriched report allows you to filter "passwordless capable" users and better prepare the necessary communications or training before global activation of the feature.

Tenant-Wide Activation

The main challenge with this update is its tenant-wide application. Microsoft has not yet planned a gradual rollout for pilot groups or specific users. Once enabled, all eligible users automatically see this capability in their My Sign-Ins interface.

Implementation Steps

Before making your decision:

1. Identify your legacy dependencies: which applications, services, or accounts still require a password?
2. Analyze potential impacts: assess whether your current password and authentication policies need adjustments.
3. Training and communication: prepare your users for this new capability. Clear documentation can reduce disruptions.

Conclusion

By introducing a simplified path for users without an active password, Microsoft Entra ID harmonizes passwordless and legacy experiences. This feature, while secondary in daily use, helps reduce tickets related to forgotten passwords and strengthens the adoption of modern authentication methods.

Prepare your tenant now for this October 2026 rollout to get the most out of this new feature and minimize friction in your hybrid environment.