EIDSCA.AP01 - Default Authorization Settings - Enabled Self service password reset for administrators.
Overview
Indicates whether administrators of the tenant can use the Self-Service Password Reset (SSPR). The policy applies to some critical critical roles in Microsoft Entra ID.
Administrators with sensitive roles should use phishing-resistant authentication methods only and therefore not able to reset their password using SSPR.
Test script
https://graph.microsoft.com/beta/policies/authorizationPolicy
.allowedToUseSSPR -eq 'false'
Remediation action
Microsoft Graph PowerShell: Update-MgPolicyAuthorizationPolicy -BodyParameter @{ allowedToUseSSPR = $false }
Related links
- Open in Graph Explorer
- authorizationPolicy resource type - Microsoft Graph beta | Microsoft Learn
- View in Microsoft Entra admin center
MITRE ATT&CK
| Tactic | Technique | Mitigation |
|---|---|---|
| TA0006 - Credential Access - Credential Access |
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.AP01 |
| Severity | High |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Feature | User and directory settings |
| Area | Privileged access |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1098 Account Manipulation |
| Supports controls | nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCheckEidscaAP01 |
| Services | Graph |
Source
- Test:
tests/eidsca/Test.EIDSCA.AP01.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.AP01.md