This cmdlet allows admins to set or reset the password of a user in Microsoft Entra ID. It is used in several situations—when a user forgets their password and needs help regaining access, when there's a suspicion that an account has been compromised and needs immediate securing, or when an organization enforces periodic password changes (such as every 90 days) as part of its security policy, among others.
Unlike in traditional AD environments where passwords are stored and protected with NT hashes, cloud-only environments like Microsoft Entra ID manage authentication through more modern methods. However, password hygiene remains essential, as user credentials are still a key target for attackers.
When an admin resets a user's password using the Set-MsolUserPassword cmdlet, they can also force the user to change it at their next login, helping to maintain security continuity after a manual reset.
Note: The Set-MsolUserPassword cmdlet is part of the MSOnline module, which is deprecated by Microsoft. Microsoft now recommends using Microsoft Graph PowerShell for managing user accounts and passwords in Microsoft Entra ID.
Before resetting a password with Microsoft Graph, ensure:
Install-Module Microsoft.Graph -Scope CurrentUser Connect-MgGraph -Scopes "User.ReadWrite.All" This command requires the User.ReadWrite.All permission (admin consent required).
Update-MgUser -UserId user@domain.com -PasswordProfile @{Password = "NewStrongPassword!23"} | Cmdlet component | Description |
|---|---|
| Update-MgUser | Microsoft Graph cmdlet for updating user account properties. |
| -UserId "user@domain.com" | Specifies the user to update. This can be the User Principal Name (UPN) or object ID. In this case, user@domain is the user whose password is being updated. |
| -PasswordProfile | A parameter group for setting password-related values. |
| Password = "NewStrongPassword!23" | Sets the new password for the user. Must meet your organization's password complexity policy. In this case, NewStrongPassword!23 is the new password. |
Note: Unlike with the MSOnline module, Microsoft Graph does not help you generate random passwords.
Update-MgUser -UserId "user@domain.com" -PasswordProfile @{Password = "NewStrongPassword!23"; ForceChangePasswordNextSignIn = $true} | Cmdlet component | Description |
|---|---|
| Update-MgUser | Microsoft Graph cmdlet for updating user account properties. |
| -UserId "user@domain.com" | Specifies the user to update. This can be the UPN or object ID. In this case, user@domain is the user whose password is being updated. |
| -PasswordProfile | A parameter group for setting password-related values. |
| Password = "NewStrongPassword!23" | Sets the new password for the user. Must meet your organization's password complexity policy. In this case, NewStrongPassword!23 is the new password. |
| ForceChangePasswordNextSignIn = $true | Ensures the user is prompted to change their password on the next login. Recommended for security. |
$users = @("user1@domain.com", "user2@domain.com", "user3@domain.com")
foreach ($user in $users) {
Update-MgUser -UserId $user -PasswordProfile @{
Password = "SecureTemp!789"
}
}
| Cmdlet component | Description |
|---|---|
| $users = @(...) | Array of UPNs or object IDs for which the password will be reset. |
| foreach ($user in $users) | Loops through each user. |
| Update-MgUser | Microsoft Graph cmdlet for updating user account properties. |
| -UserId $user | Specifies the current user in the loop. This can be the UPN or object ID. |
| -PasswordProfile @{...} | A parameter group for setting password-related values. |
| Password = "SecureTemp!789" | Sets the new password for the user. Must meet your organization's password complexity policy. In this case, SecureTemp!789 is the new password. |
$users = @("user1@domain.com", "user2@domain.com", "user3@domain.com")
foreach ($user in $users) {
Update-MgUser -UserId $user -PasswordProfile @{
Password = "SecureTemp!789"
ForceChangePasswordNextSignIn = $true
}
}
| Cmdlet component | Description |
|---|---|
| $users = @(...) | Array of UPNs or object IDs for which the password will be reset. |
| foreach ($user in $users) | Loops through each user. |
| Update-MgUser | Microsoft Graph cmdlet for updating user account properties. |
| -UserId $user | Specifies the current user in the loop. This can be the UPN or object ID. |
| -PasswordProfile @{...} | A parameter group for setting password-related values. |
| Password = "SecureTemp!789" | Sets the new password for the user. Must meet your organization's password complexity policy. In this case, SecureTemp!789 is the new password. |
| ForceChangePasswordNextSignIn = $true | Ensures the users are prompted to change their password on the next login. Recommended for security. |
Although Microsoft Graph PowerShell is powerful, it's still limited in some areas:
