Can a third-party app reset Entra ID user passwords via Graph API with app-only permissions? Is there an official supported endpoint?

Hello everyone,

We plan to build an internal self-service portal using a third-party daemon app with pure app-only authentication (no interactive admin sign-in) to reset passwords for other Entra ID users.

I would like to confirm the following:

1. Does Microsoft Graph provide an official endpoint to reset user passwords by updating the passwordProfile under the app-only permission model? Is User-PasswordProfile.ReadWrite.All the least-privilege application permission for this operation?
2. What are the limitations of this capability? For example, does it only work for cloud-only accounts? Are hybrid AD synced accounts affected?
3. Will this Graph password reset API be impacted by the upcoming retirement of SMS and phone call authentication methods for Microsoft MFA?

We also want to know the security risks and auditing best practices when granting permissions for password modification.

Thanks.