> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/microsoft-365-reset-credentials.md).

# Microsoft 365: Reset Credentials

*This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [*Enable an Auto Remediation in Workbench*](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.*

## Scope and Limitations <a href="#h_01j7kypdqgb3n0715pj3hey31m" id="h_01j7kypdqgb3n0715pj3hey31m"></a>

When choosing to enable this auto remediation, remember the following:

* This auto remediation will not work on admin user accounts or on accounts that Microsoft considers Privileged (as these accounts cannot be forced to change their password).
* While an account is temporarily disabled, the user will be unable to reset their password; they will be forced to change their password as soon as the account is re-enabled.

**If you have an on-prem Active Directory or hybrid Entra ID/ on-prem Active Directory environment**, consider the following safety precautions before enabling this auto remediation:

* In hybrid environments, the on-prem AD configuration always takes precedence and is considered the "source of truth." Microsoft initiates automatic syncs from on-prem AD to Entra ID every 30-60 minutes. Make sure to enable password writeback so that password changes made in Microsoft Entra ID are synchronized back to your local active directory (password writeback is not enabled by default in a hybrid environment).
* The Reset Credentials auto remediation will not prompt the affected user to set a new password until the account in question has been unlocked. If an account unlocks (due to sync) prior to client engagement, there is a risk that the bad actor with access to the account could reset credentials and maintain access before client engagement. This risk can be addressed by MFA implementation, as [required by Microsoft](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet) for all Azure sign-in attempts.

## Prerequisites <a href="#h_01j7kypdqg3f3s33034zmvxxbs" id="h_01j7kypdqg3f3s33034zmvxxbs"></a>

1. You must be an Azure admin for your organization, as you must have the ability to grant app permissions and add assignments.
2. You must have admin access in Workbench, as auto remediations are enabled at the organization level.
3. Make sure all end user accounts have MFA enabled, to allow the auto remediation to run properly.
4. Make sure to enable password writeback so that password changes made in Microsoft Entra ID are synchronized back to your local active directory (password writeback is not enabled by default in a hybrid environment).

## Step 1: Grant Necessary Permissions <a href="#h_01j7kypdqgwswbqzpav08nn2v0" id="h_01j7kypdqgwswbqzpav08nn2v0"></a>

The remediation actions the Expel SOC creates in Workbench will run in your vendor technology, so granting us certain permissions is required. The way you grant us these permissions will depend on how you set up your initial Microsoft 365 security device.&#x20;

* If you chose to use the Expel application during your onboarding, go to [Option 1](#h_01j7kypdqgcasm9sv3y64ssvhj).
* If you chose to create your own custom Microsoft Entra ID application during your onboarding, go to [Option 2](#h_01j7kypdqghg5vpsznkhb8xm6k).
* If you aren't sure, go to your enterprise applications in Azure and look for either the Expel Microsoft 365 Integration application or your custom application. Then proceed based on which one you find.

### Option 1: Grant Permissions in the Expel Application <a href="#h_01j7kypdqgcasm9sv3y64ssvhj" id="h_01j7kypdqgcasm9sv3y64ssvhj"></a>

If you chose to use the Expel Microsoft 365 Integration application during your security device onboarding, you will simply need to grant admin consent so that we may perform the auto remediation.

{% hint style="info" %}
If you have set up other auto remediations for Microsoft 365, you may have completed this step already. We recommend that you verify this permission before moving on to [Step 2](#h_01j7kypdqgpw4e0yb9fg0gjqcr).
{% endhint %}

1. Log in to <https://portal.azure.com/>.
2. Select **Enterprise Applications**.
3. Select the Expel application.
4. In the left menu, go to **Security > Permissions**.
5. Select the **Grant admin consent for Expel** button.
6. Select the **Refresh** option to verify that the permissions have been updated.
7. Go to [Add an Expel Assignment to the User Administrator Role](#h_01j7kypdqgpw4e0yb9fg0gjqcr).

### Option 2: Grant Permissions in Your Microsoft Entra ID Application <a href="#h_01j7kypdqghg5vpsznkhb8xm6k" id="h_01j7kypdqghg5vpsznkhb8xm6k"></a>

If you chose to create your own custom application during your security device onboarding, you will need to grant us with admin consent *and* add user read/write permissions for the Microsoft Graph API so that we may perform the auto remediation.

1. Log in to <https://portal.azure.com/>.
2. Use the search field to locate the **Expel Cloud Service** application, which will display within the MicroSoft Entra ID section of the search results (you registered and created this app during your security device onboarding). Locating it in this manner will allow you to configure permissions via Application Registration.
3. Go to **Manage > API Permissions**.
   * If you do not see this option, you are not in the right place. Try going to Security > Permissions and looking for a message that says "To configure requested permissions for apps you own, use the app registration." The accompanying Application Registration link will take you to the right place.
4. If you see the **User.ReadWrite.All** permission in the configured permissions for Microsoft Graph *and* the type shows as **Application**, you are done and can skip to [Add an Expel Assignment to the User Administrator Role](#h_01j7kypdqgpw4e0yb9fg0gjqcr). If not, continue to step 5.
5. Select **Add a permission**.
6. Select **Microsoft Graph**.
7. Select **Application permissions** as the type.
8. Navigate to the **User.ReadWrite.All** permission and use the checkbox to select it.
9. Select **Add permissions** to save your changes.
10. Use the search field to find and select **Enterprise Applications**.
11. Select your custom application.
12. In the left menu, go to **Security > Permissions**.
13. Select the **Grant admin consent for Expel** button.
14. Select the **Refresh** option to verify that the permissions have been updated.

## Step 2: Add an Expel Assignment to the User Administrator Role <a href="#h_01j7kypdqgpw4e0yb9fg0gjqcr" id="h_01j7kypdqgpw4e0yb9fg0gjqcr"></a>

You will need to add an assignment for Expel within the User Administrator role to allow us to reset user credentials.

1. Still in the Azure portal, search for **Microsoft Entra ID**.
2. Go to **Manage > Roles and Administrators**.
3. Search for and select the **User Administrator** role.
4. Select **Add assignments** to add the assignment for Expel. *Important: This assignment must be added to the Expel application or to your custom application (whichever one you configured in the previous section).*

If you need additional help with assignments, refer to the [Azure documentation](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-overview).&#x20;

## Step 3: Update Your Context <a href="#h_01jhrm39k6zwpsdc6r9c995qgr" id="h_01jhrm39k6zwpsdc6r9c995qgr"></a>

**If you do not want to specify any credentials for a "do not reset" or "always reset" list, and instead wish for Expel to automatically reset all identified credentials, skip to** [**Step 4**](#h_01j7kypdqgvzxv5wa84vspabyr)**.**

Working with your Customer Success Manager, prepare to create an allow or deny list by adding credentials as context for your environment. You will then be able to select those credentials as "Never reset" or "Always reset" assets when you enable the auto remediation in Workbench.

{% hint style="info" %}
If our SOC identifies credentials that must be reset and you have created either an allow ("Always reset") or deny ("Never reset") list in Workbench, any credentials falling outside of those parameters are assigned to you as actions rather than being reset automatically.
{% endhint %}

## Step 4: Return to the Main Setup Guide <a href="#h_01j7kypdqgvzxv5wa84vspabyr" id="h_01j7kypdqgvzxv5wa84vspabyr"></a>

Your Microsoft 365 device is now ready for the Reset Credentials auto remediation. You should now do one of the following:

* **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process.
* **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/microsoft-365-reset-credentials.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.