How to change Entra ID passwords using the Update-MgUserPassword cmdlet

What is the Update-MgUserPassword cmdlet?

The Update-MgUserPassword command is used in Microsoft Graph PowerShell to update the password of a user account in Microsoft Entra ID. This cmdlet allows users to update their own passwords without requiring administrative roles. This self-service feature reduces dependency on IT teams and enhances security by allowing users to manage their credentials independently.

Updating Entra ID passwords using Graph PowerShell

Prerequisites

Before using the Update-MgUserPassword cmdlet, ensure the following prerequisites are met:

  • Verify that the Graph PowerShell module is installed. If not, install it using this script:
    Install-Module Microsoft.Graph -Scope CurrentUser
  • Connect to Graph PowerShell with the required permissions to update passwords.
  • Ensure the signed-in user has the following permissions for self-service password changes:
    • UserAuthenticationMethod.ReadWrite
    • User.ManageIdentities.All (for managing additional authentication factors)

Using the Update-MgUserPassword cmdlet

Here's how you can use the Update-MgUserPassword cmdlet to change Entra ID passwords:

Update-MgUserPassword
-UserId <String>
[-ResponseHeadersVariable <String>]
[-AdditionalProperties <Hashtable>]
[-CurrentPassword <String>]
[-NewPassword <String>]
[-Headers <IDictionary>]
[-PassThru]
[-ProgressAction <ActionPreference>]
[-WhatIf]
[-Confirm]
[<CommonParameters>]

Example: Changing a user password

$params = @{
currentPassword = "ryTG67@3rygjh"
newPassword = "j739YteRpo#7789"
}
Update-MgUserPassword -UserId $userId -BodyParameter $params

Supported parameters

The following table lists some parameters that can be used along with the Update-MgUserPassword cmdlet:

Parameters Description
-CurrentPassword This parameter allows you to specify your existing password for verification.
-NewPassword This parameter allows you to specify the new password that you would like to set.
-UserId This parameter allows you to specify the user ID, such as the UserPrincipalN ame, object ID, or other identifiers.
-Confirm This parameter asks for confirmation before executing the cmdlet.

Limitations of using Graph PowerShell scripts to change Entra ID passwords

While Graph PowerShell allows users to update their own passwords using the Update-MgUserPassword cmdlet, it has several limitations:

  • Changing passwords using Graph PowerShell requires scripting knowledge, which can be challenging for non-technical users.
  • Graph PowerShell lacks an intuitive interface, increasing the likelihood of mistakes.
  • Graph PowerShell does not require any additional verification methods, potentially impacting security.
  • There is no built-in reporting or audit trail for password changes.

ADManager Plus, an IGA solution with Microsoft 365 management and reporting capabilities, helps administrators overcome the common limitations of Graph PowerShell. By offering an intuitive interface, automation features, and advanced reporting capabilities, ADManager Plus enables efficient, streamlined user management in Entra ID.

Highlights of using ADManager Plus to manage Entra ID users

  • Unlike PowerShell, ADManager Plus provides a graphical interface, making it easier for help desk technicians and administrators to manage Entra ID.
  • ADManager Plus allows you to create, update, or delete multiple Entra ID users at once using CSV imports.
  • Generate detailed reports on user activity, group memberships, and more and manage users on the fly.
  • Define multi-level approval processes for critical identity management tasks and ensure security.

Manage Entra ID users effortlessly with ADManager Plus

 
  • What is the Update-MgUserPassword cmdlet?
  • Changing Entra ID passwords using the Update-MgUserPassword cmdlet
  • Limitations of using Graph PowerShell scripts to change Entra ID passwords
  • Why choose ADManager Plus to manage Entra ID?
The one-stop solution to Active Directory Management and Reporting
Email Download Link