Unable to reset expired password for Microsoft Entra user in my tenant

Reset the user’s password from the Microsoft Entra admin center, and if that fails, check for on-premises/hybrid constraints and SSPR configuration.

1. Reset the password in Microsoft Entra ID
   1. Sign in to the Microsoft Entra admin center as at least a Password Administrator or User Administrator.
   2. Go to Entra ID → Users.
   3. Search for the affected user and open the user’s profile.
   4. Select Reset password.
   5. On the Reset password pane, select Reset password again.
      • In cloud-only scenarios, Microsoft Entra ID autogenerates a temporary password.
   6. Copy the temporary password and provide it to the user. The user must change it at next sign-in.
   If this operation succeeds, the expired-password condition (AADSTS50055) is cleared when the user signs in with the new password and completes the forced change.
2. If the reset fails with a writeback/on-premises policy error If the tenant is hybrid and password writeback is enabled, the reset can be blocked by on-premises Active Directory password policy:
   • In the Azure portal, when attempting a reset, an error like:

     Unfortunately, you cannot reset this user's password because your on-premises policy does not allow it. indicates the on-premises DC rejected the password.

   • In that case, review the on-premises password policy (length, complexity, age, history) and ensure the temporary or chosen password complies.
   • On a domain controller, check Event Viewer → Windows Logs → Security for Event ID 4724 with Audit Failure to see why the password was rejected.
3. If SSPR or admin reset is blocked by tenant configuration
   • If users see SSPR errors like TenantSSPRFlagDisabled = 9 or SSPR_0009, enable SSPR on the tenant.
   • For synchronized administrators blocked by SSPR-009, enable SSPR-A on the tenant using Microsoft Graph PowerShell:

          Import-Module Microsoft.Graph.Identity.SignIns
          
          $params = @{allowedToUseSSPR = $true}
          
          Update-MgPolicyAuthorizationPolicy -BodyParameter $params
     

   • Ensure password writeback is enabled if cloud resets must write back to on-premises AD.
4. Clear the expired-password sign-in error
   • After a successful admin reset or compliant password change, have the user sign in again.
   • The AADSTS50055 error (password expired) is resolved once the user completes sign-in with the new password and any required password change.

If the tenant is purely cloud-only (no on-premises AD or writeback) and the admin reset still fails with the generic “not able to reset this user’s password right now” message, use the admin reset steps above again after some time and verify the account and license state, as the standard cloud reset path is the supported way to clear an expired password.

References:

• Reset a user's password
• Troubleshoot password resets that are blocked by on-premises policy
• Troubleshoot self-service password reset in Microsoft Entra ID
• Troubleshoot error SSPR_009: Synchronized Microsoft Entra Administrator can't reset password from the cloud
• Error AADSTS50000 getting a token or signing in to an Azure app
• Problems signing in to a Microsoft application