Reset Student Passwords with Azure/Entra Portal

Requirements for Access

Authorized D93 Staff members are now able to reset Student passwords via Microsoft Entra (formerly Azure) portal. Users will need to be assigned the Helpdesk Administrator Role within the ‘Student User Accounts’ Administrative Unit. They will also need to have their Microsoft 2-Factor-Authentication setup.  

At the time of this article, the individuals within the Student Password Reset AAD group in M365 are assigned the correct roles and scopes. This group has members manually assigned (M365 does not allow dynamic membership, or nested groups to be assigned Administrative Roles). If you are not already in this group, please reach out to your M365 Administrator through a work order to request access. 

How to Access

Authorized users will not access Entra/Azure directly (at the time of this article access to the Administrative Entra Portal is blocked by Conditional Access), instead they will use a portal to see users within the Administrative Unit. This link can be accessed through classlink, and will show up as a circular blue lock labeled Student Password Reset. This link is set to show up for Principals, Secretaries, and a few other groups. 

You may access this portal with your @d93.k12.id.us email and password, and upon successful login will see a long list of users (in this case all D93 students).

When you find the correct user to reset their password, you will be met with a simple menu with just one option to reset password. It is by Microsoft design that this will not set their password within this portal, but rather set a temporary password that they will then be prompted to change when they log into a D93 Windows device or Classlink (As of this article, @d93mail Gmail passwords if changed do not write back to any accounts. Changing your password on Google will not effect any other district accounts, and will eventually be overwritted by what is changed from Windows Desktop, Classlink, or Active Directory). 

A temporary password must meet microsoft security guidelines and include: 

• A minimum of 8 characters and three out of four of the following types of characters:
  
  • Lowercase characters
  • Uppercase characters
  • Numbers (0-9)
  • Symbols @ # $ % ^ & * - _ ! + = [ ] { } | \ : ' , . ? / ` ~ " ( ) ; < > 
  • ATTN: cannot contain any part of users name

Searching Issues

Rather than scrolling through a list of 13,000+ users, you can utilize the search function to find a specific individual. Unfortunately, this search function is very limited, as we can only search using a full name (First, Middle, Last and in that order. You cannot search for just middle or last name) and it must be spelled correctly.

Furthermore, using the search function will show all @d93.k12.id.us accounts as results, but you will only be able to reset passwords for students.