EIDSCA.AP01: Default Authorization Settings - Enabled Self service password reset for administrators.

ID	EIDSCA.AP01
Severity	High
Suite	EIDSCA
Product	Entra ID
Feature	User and directory settings
Security area	Privileged access
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Framework controls	nist-800-53-r5:IA-5 Authenticator Management
MITRE ATT&CK	T1098
Reads from	Microsoft Graph

What this checks and how to fix it

Indicates whether administrators of the tenant can use the Self-Service Password Reset (SSPR). The policy applies to some critical critical roles in Microsoft Entra ID.

Administrators with sensitive roles should use phishing-resistant authentication methods only and therefore not able to reset their password using SSPR.

Test script

https://graph.microsoft.com/beta/policies/authorizationPolicy
.allowedToUseSSPR -eq 'false'

Remediation action

Microsoft Graph PowerShell: Update-MgPolicyAuthorizationPolicy -BodyParameter @{ allowedToUseSSPR = $false }

Related links

• Open in Graph Explorer
• authorizationPolicy resource type - Microsoft Graph v1.0 | Microsoft Learn
• View in Microsoft Entra admin center

MITRE ATT&CK

mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0006 - Credential Access - Credential Access
    (Mitigation)

    (Technique)

Tactic	Technique	Mitigation
TA0006 - Credential Access - Credential Access

---

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.