> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/microsoft-entra-id-via-event-hub-reset-credentials.md).

# Microsoft Entra ID via Event Hub: Reset Credentials

*This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [*Enable an Auto Remediation in Workbench*](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.*

This guide helps you set up your Microsoft Entra ID via Event Hub device so that you can enable the Reset Credentials auto remediation in Workbench. During the setup process, you will grant Expel all necessary permissions for the remediation to work.

## Scope and Limitations

When choosing to enable this auto remediation, remember the following:

* This auto remediation will not work on admin user accounts or on accounts that Microsoft considers Privileged (as these accounts cannot be forced to change their password).
* While an account is temporarily disabled, the user cannot have their credentials reset. It is therefore recommended that, in the event of a suspected compromised user, this remediation is applied directly before the Disable Accounts remediation is applied.

**If you have an on-prem Active Directory or hybrid Entra ID/ on-prem Active Directory environment**, consider the following safety precautions before enabling this auto remediation:

* In hybrid environments, the on-prem AD configuration always takes precedence and is considered the "source of truth." Microsoft initiates automatic syncs from on-prem AD to Entra ID every 30-60 minutes. Make sure to enable password writeback so that password changes made in Microsoft Entra ID are synchronized back to your local active directory (password writeback is not enabled by default in a hybrid environment).
* The Reset Credentials auto remediation will not prompt the affected user to set a new password until the account in question has been unlocked. If an account unlocks (due to sync) prior to client engagement, there is a risk that the bad actor with access to the account could reset credentials and maintain access before client engagement. This risk can be addressed by MFA implementation, as [required by Microsoft](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet) for all Azure sign-in attempts.

## How It Works <a href="#h_01kcq58zyx8ybb32hecxz7qhhp" id="h_01kcq58zyx8ybb32hecxz7qhhp"></a>

This remediation forces a password change at the next login, and revokes sessions and refresh tokens. It does not set a new password.

### Endpoints Used <a href="#h_01kcq58zyx8ybb32hecxz7qhhp" id="h_01kcq58zyx8ybb32hecxz7qhhp"></a>

**Microsoft Graph API**

`v1.0`, `beta`

<table><thead><tr><th width="123.40625">Method</th><th>Endpoint</th><th>Purpose</th></tr></thead><tbody><tr><td>GET</td><td><code>v1.0/users/{userid}</code></td><td>Get user; read <code>passwordProfile</code> for the pre-check</td></tr><tr><td>PATCH</td><td><code>v1.0/users/{userid}</code></td><td>Force change at next sign-in; sets <code>passwordProfile.forceChangePasswordNextSignInWithMfa</code> (falls back to <code>forceChangePasswordNextSignIn</code>)</td></tr><tr><td>POST</td><td><code>v1.0/users/{userid}/revokeSignInSessions</code></td><td>Revoke all sign-in sessions</td></tr><tr><td>POST</td><td><code>beta/users/{userid}/invalidateAllRefreshTokens</code></td><td>Revoke all refresh tokens</td></tr></tbody></table>

## Prerequisites

1. You must be an Azure admin for your organization, as you must have the ability to grant app permissions and add assignments.
2. You must have admin access in Workbench, as auto remediations are enabled at the organization level.
3. You must have already completed all of the steps in [Microsoft Entra ID via Event Hub Setup for Workbench](/connect-your-technology/l-p-integrations/microsoft/microsoft-entra-id-via-event-hub-setup-for-workbench.md).
4. Make sure all end user accounts have MFA enabled, to allow the auto remediation to run properly.
5. Make sure to enable password writeback so that password changes made in Microsoft Entra ID are synchronized back to your local active directory (password writeback is not enabled by default in a hybrid environment).

## Step 1: Grant Necessary Permissions

The remediation actions the Expel SOC creates in Workbench will run in your vendor technology, so granting us certain permissions is required.

1. [Log in to Azure](https://portal.azure.com/).
2. Navigate to the **Microsoft Entra ID** service.
3. Go to **Manage > App registrations**.
4. Select the custom Entra ID app you created when you [set up your Expel integration](/connect-your-technology/l-p-integrations/microsoft/microsoft-entra-id-via-event-hub-setup-for-workbench.md#step-2-create-a-custom-entra-id-app).
5. Navigate to **Manage > API permissions**.
6. Locate the **Microsoft Graph** API and add the following two permissions:
   * `Directory.ReadWrite.All`
   * `User.RevokeSessions.All`
7. Make sure to **Grant admin consent** for both permissions.

## Step 2: Update Your Context

**If you do not want to specify any credentials for a "do not reset" or "always reset" list, and instead wish for Expel to automatically reset all identified credentials, skip to** [**Step 3**](#step-3-return-to-the-main-setup-guide)**.**

Working with your Customer Success Manager, prepare to create an allow or deny list by adding credentials as context for your environment. You will then be able to select those credentials as "Never reset" or "Always reset" assets when you enable the auto remediation in Workbench.

{% hint style="info" %}
If our SOC identifies credentials that must be reset and you have created either an allow ("Always reset") or deny ("Never reset") list in Workbench, any credentials falling outside of those parameters are assigned to you as actions rather than being reset automatically.
{% endhint %}

## Step 3: Return to the Main Setup Guide <a href="#step-3-return-to-the-main-setup-guide" id="step-3-return-to-the-main-setup-guide"></a>

Your Microsoft Entra ID via Event Hub device is now ready for the Reset Credentials auto remediation. You should now do one of the following:

* **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process.
* **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/microsoft-entra-id-via-event-hub-reset-credentials.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.