MC1437671 - Microsoft Entra: Authenticated password change in My Sign-Ins

Updated October 9,7, 2026: We have updated the timeline and content. Thank you for your patience. 

What and Why

We're introducing a new Microsoft Entra capability that Allowallows authenticated password change after secure sign-inchanges directly from My Sign-Ins using an existing strong credential, such as a passkey, FIDO2 security key, or Windows Hello for Business. Users can complete this action even if they don't know their current password and without using self-service password reset (SSPR) or contacting the helpdesk.

Many organizations are adopting allowedauthenticated password changes after secure sign-inschange but still maintain passwords for legacy applications and services. This update helps reduce password-related support requests and removes a common barrier to adoption. The feature is disabled by default and requires administrator enablement before users can access it.

Rollout Schedule

• General Availability (Worldwide and GCC): Beginning in end of mid-October 2026 (previously mid-October) and expected to complete by end of Novemberlate October 2026 (previously late October)

Impact on Your Organization

Who is affected

• Microsoft Entra administrators who manage password change settings
• Users who have a registered allowedauthenticated password change after secure sign-in method (passkey, FIDO2 security key, or Windows Hello for Business) and also maintain a password
• Organizations that choose to enable the feature

Platforms/Services

• Microsoft Entra
• My Sign-Ins (mysignins.microsoft.com)

What will happen

• Because this feature is off by default, there is no change to your users' experience unless you turn it on. 
• After the feature is enabled, eligible users will see a new Change password option in My Sign-Ins.
• Users can authenticate set a new password without knowing their existing password.
• Users are not required to enroll in or use SSPR to complete this action.
• Administrators can choose to enable or disable the capability through Microsoft Entra management interfaces available at release.
• Authentication continues to require a strong password change method, such as a passkey, FIDO2 security key, or Windows Hello for Business.
• The setting is tenant-wide: you can turn it on for your entire tenant or leave it off for everyone. There is no per-user or per-group scoping. 

Action Required/Recommendations

No action is required.

If your organization plans to support allowedauthenticated password changes after secure sign-in:change:

• Review your password management and allowedauthenticated password changes after secure sign-inchange strategy.
• Evaluate whether enabling this capability aligns with your organization's security and support requirements.
• Communicate the new self-service capability to helpdesk and support teams.
• Update internal user guidance and documentation as needed.
• If your organization chooses to offer allowedauthenticated password changes after secure sign-in,, enable the feature through the Microsoft Entra admin experience or supported APIs when it becomes available in October 2026.

Learn more 

• Microsoft Learn documentation will be available when the feature releases in October. 

Compliance Considerations