Link to Forgot Password/Password Reset in Entra External ID

Question

Link to Forgot Password/Password Reset in Entra External ID

metalheart 421

I create users in an External ID tenant from my app using Microsoft Graph. How can I share a link to an initial password reset in an onboarding email?

The challenge I'm facing is that the "Forgot my password" link on the login page seems to be stateful and brings the users back to the login page (they only differ by the value of the state query param). This behavior seems to be different from AAD B2C where the Forgot/Reset password flows were dedicated user flows and performing them was possible with separate URLs.

The background is that the users currently need to click "Forgot my password" when visiting the site for the first time which is rather counterintuitive as they hadn't set any password yet. If the above is not viable for some reason, is there any recommendation what to do instead?

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-03T10:22:46.7633333+00:00
Hello metalheart,

I understand that you want to use Microsoft Graph to programmatically create users in a Microsoft Entra External ID tenant. and, you want to send them an onboarding email that allows them to set their initial password, much as the password reset or dedicated user flow experience offered by Azure AD B2C.

When users are created using Microsoft Graph, Microsoft Entra External ID does not support creating a direct, shareable "password reset" or "set initial password" link. The sign-in page's "Forgot my password" option is stateful; it only functions as part of the active authentication session and cannot be used as a static URL.

Hence as a workaround, while creating the user via Graph, include the passwordProfile property:

"passwordProfile": { "password": "xxx", "forceChangePasswordNextSignIn": true }

Next, include the sign-in URL for your application to the onboarding email. The user will be immediately requested to create a new password when they log in for the first time.

Reference:

Entra External ID (External Tenant): How to send an email notification/invitation to local user created via “Create User” endpoint of Graph API - Microsoft Q&A
metalheart 421 Reputation points

2025-11-03T10:53:32.3133333+00:00

The approach you're suggesting would require the app to share the initial password "xxx" in the email - setting a new password only happens after the initial authentication. This is not secure enough - any other suggestions?
RoryB 705 Reputation points

2025-11-04T01:24:33.94+00:00

An approach that may work for you is to use the native auth. SSPR.

This involves a series of requests/responses, so the URL in the email would have to point to a flow that allows this.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-04T11:56:50.8066667+00:00

Hello metalheart,

I agree with you, sharing a temporary password isn’t secure. Otherwise, make use of the Microsoft Graph invitation API instead it sends a secure onboarding link where users can set their password safely.

Let me know if any further queries - feel free to reach out!
metalheart 421 Reputation points

2025-11-04T13:50:56.5766667+00:00

Except that invitations are only used for B2B users as per MS Graph docs and my question about password reset implies I'm talking about local users.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-04T13:54:49.83+00:00

Hello metalheart,

I agree with you that the invitations are only used for B2B users, not local users in Entra External ID.

However, currently for local (email-based) users, Entra External ID doesn’t currently provide a public endpoint or static “set password” or “reset password” link. Try self-service password reset (SSPR).
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-05T09:14:29.8333333+00:00

Hello metalheart, Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Carolyne Milgo 1,151 Reputation points

2025-11-05T09:49:07.7533333+00:00

In Microsoft Entra External ID, there isn’t a dedicated password reset flow URL like in Azure AD B2C user flows. The “Forgot my password” link on the login page is stateful and tied to the sign-in context, so you can’t generate a standalone reset link for onboarding emails. For local users who haven’t set a password yet, the recommended approach is to use the self-service password reset (SSPR) capability.
Ensure SSPR is enabled for the tenant and include instructions in the onboarding email telling users to click “Forgot my password” on the sign-in page to set their initial password. Alternatively, you can predefine a temporary password during user creation and require a change on first sign-in, which is supported via Microsoft Graph by setting passwordProfile.forceChangePasswordNextSignIn = true.

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-03T10:22:46.7633333+00:00

Hello metalheart,

I understand that you want to use Microsoft Graph to programmatically create users in a Microsoft Entra External ID tenant. and, you want to send them an onboarding email that allows them to set their initial password, much as the password reset or dedicated user flow experience offered by Azure AD B2C.

When users are created using Microsoft Graph, Microsoft Entra External ID does not support creating a direct, shareable "password reset" or "set initial password" link. The sign-in page's "Forgot my password" option is stateful; it only functions as part of the active authentication session and cannot be used as a static URL.

Hence as a workaround, while creating the user via Graph, include the passwordProfile property:

"passwordProfile": { "password": "xxx", "forceChangePasswordNextSignIn": true }

Next, include the sign-in URL for your application to the onboarding email. The user will be immediately requested to create a new password when they log in for the first time.

Reference:

Entra External ID (External Tenant): How to send an email notification/invitation to local user created via “Create User” endpoint of Graph API - Microsoft Q&A
metalheart 421 Reputation points

2025-11-03T10:53:32.3133333+00:00

The approach you're suggesting would require the app to share the initial password "xxx" in the email - setting a new password only happens after the initial authentication. This is not secure enough - any other suggestions?
RoryB 705 Reputation points

2025-11-04T01:24:33.94+00:00

An approach that may work for you is to use the native auth. SSPR.

This involves a series of requests/responses, so the URL in the email would have to point to a flow that allows this.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-04T11:56:50.8066667+00:00

Hello metalheart,

I agree with you, sharing a temporary password isn’t secure. Otherwise, make use of the Microsoft Graph invitation API instead it sends a secure onboarding link where users can set their password safely.

Let me know if any further queries - feel free to reach out!
metalheart 421 Reputation points

2025-11-04T13:50:56.5766667+00:00

Except that invitations are only used for B2B users as per MS Graph docs and my question about password reset implies I'm talking about local users.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-04T13:54:49.83+00:00

Hello metalheart,

I agree with you that the invitations are only used for B2B users, not local users in Entra External ID.

However, currently for local (email-based) users, Entra External ID doesn’t currently provide a public endpoint or static “set password” or “reset password” link. Try self-service password reset (SSPR).
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2025-11-05T09:14:29.8333333+00:00

Hello metalheart, Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Carolyne Milgo 1,151 Reputation points

2025-11-05T09:49:07.7533333+00:00

In Microsoft Entra External ID, there isn’t a dedicated password reset flow URL like in Azure AD B2C user flows. The “Forgot my password” link on the login page is stateful and tied to the sign-in context, so you can’t generate a standalone reset link for onboarding emails. For local users who haven’t set a password yet, the recommended approach is to use the self-service password reset (SSPR) capability.
Ensure SSPR is enabled for the tenant and include instructions in the onboarding email telling users to click “Forgot my password” on the sign-in page to set their initial password. Alternatively, you can predefine a temporary password during user creation and require a change on first sign-in, which is supported via Microsoft Graph by setting passwordProfile.forceChangePasswordNextSignIn = true.