Update user (passwordProfile): docs say an Entra role is required for app-only calls, but User-PasswordProfile.ReadWrite.All alone works

The supported configuration still requires both User-PasswordProfile.ReadWrite.All application permission and at least the User Administrator role for the calling service principal, even though the successful role-less request indicates that this requirement is not consistently enforced for the tested case.

What can be concluded

The current documentation contains a genuine contradiction:

• The passwordProfile property description requires an app-only caller to have a supported Graph permission and at least the User Administrator role.
• The scenario-specific permissions section and Example 3 identify User-PasswordProfile.ReadWrite.All as the least-privileged application permission without repeating the role requirement.^1^
• The user resource documentation separately repeats the application permission-plus-role requirement and classifies passwordProfile as a sensitive action.^2^
• User.ReadWrite.All explicitly excludes passwordProfile, so User-PasswordProfile.ReadWrite.All remains the correct Graph application permission.^3^

A successful role-less reset does not establish that the role requirement has been removed from the supported authorization contract. The available public documentation does not specify where or for which targets the backend currently omits that check.

If the tested target was a non-admin member user—and the new password was confirmed at sign-in—the result demonstrates current behavior for that particular tenant and target classification. It does not establish behavior for administrator accounts, role-assignable-group members, restricted administrative units, guests, external tenants, or other tenant configurations.

Administrator targets

The documented password-reset matrix limits what each Entra role can reset:

• User Administrator can reset non-admin users and several lower-privileged administrators, including another User Administrator.
• It cannot reset Global Administrator, Privileged Authentication Administrator, Privileged Role Administrator, custom-role holders, members or owners of role-assignable groups, or users scoped to restricted management administrative units.
• Privileged Authentication Administrator is the least-privileged listed role that can reset all those protected categories.^4^

That matrix defines the documented authority of each role. It does not independently prove that every corresponding restriction is currently enforced against every app-only request.

For production, configure the documented controls:

1. Grant and admin-consent the Microsoft Graph application permission User-PasswordProfile.ReadWrite.All.
2. In the Microsoft Entra admin center, go to Identity → Roles & admins → User Administrator → Add assignments.
3. Select the enterprise application's service principal and complete the assignment using an account authorized to manage role assignments.
4. If the app must reset highly privileged or otherwise protected targets, use Privileged Authentication Administrator instead, subject to least-privilege review.
5. Acquire a new client-credentials token before retesting.

PATCH https://graph.microsoft.com/v1.0/users/{id}
Authorization: Bearer {application-token}
Content-Type: application/json

{
  "passwordProfile": {
    "forceChangePasswordNextSignIn": true,
    "password": "{temporary-password}"
  }
}

Microsoft recommends setting forceChangePasswordNextSignIn to true; passwordProfile cannot be used for federated users.^1^

Report the inconsistency through both channels

Use Learn Feedback on the article to request reconciliation of the property description, permissions section, and Example 3. Microsoft Learn's feedback mechanism routes content reports to the relevant content or product team.^5^ A documentation pull request can also be proposed through the page's edit workflow, but maintainers may need product-team confirmation before changing an authorization requirement.^6^

Separately, open a Microsoft support case through Azure portal → Help + support or the organization's Unified/Premier support channel. Documentation feedback can correct wording, but a support case is needed to investigate tenant-specific backend enforcement and obtain an authoritative product-contract answer.

Include:

• UTC timestamp, HTTP status, Graph request-id, and client-request-id
• Tenant type and sanitized tenant identifier
• Service-principal object ID and application ID
• Sanitized token roles and wids claims
• Direct and transitive role-assignment query results
• Target classification: member/guest, admin roles, role-assignable-group membership, administrative-unit scope, and federated/cloud-only status
• Confirmation of whether the changed password actually worked at sign-in

Avoid testing protected administrator accounts merely to determine enforcement; use a controlled test account and let support correlate the successful request with service-side authorization logs.

References

1. Update user
2. user resource type
3. Microsoft Graph permissions reference
4. Working with users in Microsoft Graph
5. Provide feedback for Microsoft Learn content
6. Edit Microsoft Learn documentation in the browser