Reset a Microsoft Entra ID user password with PowerShell (Update-MgUser -PasswordProfile)

To reset a user's password in Microsoft Entra ID with PowerShell, connect to Microsoft Graph with the User-PasswordProfile.ReadWrite.All scope and pass a -PasswordProfile hashtable to Update-MgUser. Set ForceChangePasswordNextSignIn = $true so the user replaces the temporary password at the next sign-in, which is what Microsoft recommends.

Connect-MgGraph -Scopes 'User-PasswordProfile.ReadWrite.All'
$temp = Read-Host 'Temporary password for adele@contoso.com'
Update-MgUser -UserId adele@contoso.com -PasswordProfile @{
  Password                      = $temp
  ForceChangePasswordNextSignIn = $true
}

Replace the UPN with yours. The cmdlet prints nothing on success; Microsoft Graph answers 204 No Content. The temporary password must meet the tenant's password policy (strong passwords by default).

The PasswordProfile object

The block lists the properties of the password profile type and the parameter type in Microsoft.Graph.Users 2.41.2, offline:

Import-Module Microsoft.Graph.Users
'-PasswordProfile type: ' + (Get-Command Update-MgUser).Parameters['PasswordProfile'].ParameterType.Name
[Microsoft.Graph.PowerShell.Models.MicrosoftGraphPasswordProfile].GetProperties() |
  Where-Object Name -ne 'EntityItem' | ForEach-Object { '{0,-38} {1}' -f $_.Name, ($_.PropertyType.Name -replace '`1', '') }
try { Update-MgUser -UserId adele@contoso.com -PasswordProfile 'text' -ErrorAction Stop } catch { $_.Exception.Message }

-PasswordProfile type: IMicrosoftGraphPasswordProfile
ForceChangePasswordNextSignIn          Nullable
ForceChangePasswordNextSignInWithMfa   Nullable
Password                               String
Cannot process argument transformation on parameter 'PasswordProfile'. Cannot convert the "text" value of type "System.String" to type "Microsoft.Graph.PowerShell.Models.IMicrosoftGraphPasswordProfile".

A string is rejected during parameter binding, as the last line shows: -PasswordProfile needs a hashtable (or a MicrosoftGraphPasswordProfile object). Keys inside the hashtable are not checked the same way, so a misspelled key is not rejected before the request is sent: copy the property names exactly.

Permissions and roles

Which admin can reset whom is defined by role: a Helpdesk Administrator, for example, cannot reset a Global Administrator. If the role is too weak, Graph returns Insufficient privileges to complete the operation.

Variants

Pitfalls

• Federated users cannot have their password set through passwordProfile.
• Avoid putting the password in the script or in command history; read it with Read-Host or generate it, and hand it to the user through a separate channel.
• The old MSOnline Set-MsolUserPassword and AzureAD Set-AzureADUserPassword cmdlets are retired with their modules; Update-MgUser is the replacement and works in Windows PowerShell 5.1 and PowerShell 7.
• Run Connect-MgGraph first, or every call ends with Authentication needed. Please call Connect-MgGraph.

FAQ