how to build a password reset self-service portal
Builds a self-service password reset portal to deflect reset tickets. Covers the options (IdP-native vs custom), auth methods, and rollout. Use when planning deflection. Not for troubleshooting existing SSPR.
TL;DR
Use the IdP-native reset (Entra SSPR, Okta self-service) unless you have a hard requirement it cannot meet; it is maintained, audited, and free with the right license. Require two auth methods, drive enrollment before launch, and measure reset ticket volume to prove the deflection.
The error
(Deflection project; no error.)Steps
- Check IdP-native first: Entra SSPR or Okta's self-service recovery. Expected: evaluated. Building custom reset is a security-sensitive project; avoid it if native works.
- If custom is required (legacy AD without Entra, exotic policy), scope carefully: the portal must verify identity with two factors before allowing a reset, and log everything. Expected: requirements written.
- Require at least two authentication methods for reset (authenticator app + phone, etc.). Expected: enforced. Single-factor reset is an account-takeover vector.
- Drive enrollment: users cannot self-serve without registered methods. Expected: enrollment campaign run. Launch the portal only after enrollment crosses your threshold.
- Launch with communications and measure: password-reset ticket volume before and after. Expected: volume drops. Report the deflection to justify the project.
When to use
- Reducing password-reset ticket volume
- No existing self-service
When not to use
- SSPR already deployed (fix adoption, not technology)
- Small orgs where resets are rare (not worth the project)
Compatibility
- Entra ID P1+, Okta; custom builds need careful security review
Variants
Helpdesk-assisted reset with verification
A middle ground: agents verify identity and trigger the reset, faster than full self-service to deploy.
Kiosk or shared devices
Self-service on shared devices needs extra care; prefer agent-assisted there.
Why it happens
Password resets are the number one helpdesk ticket category everywhere. Self-service is the highest-ROI deflection available, but only with enrollment and two-factor verification.
Edge cases
- Announce in the users' language; a portal nobody knows about deflects nothing.
- Monitor for abuse: reset portals are attacked; alert on anomalies.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_cdanPPi7WbVj8ynnbQVBXQ
Maintainer review
No maintainer verification is recorded for this version.
This records the version a maintainer checked. It does not assert that the version is the latest upstream release.