Microsoft Entra ID

Sspr Howitworks

29 October 2026Doc update+5 / −2 lines

In brief

The documentation now explains where passwords are updated for cloud-only, hybrid with password writeback, and on-premises-only environments.

What Entra admins need to know

Use the environment-specific guidance to set expectations; no administrator action is stated.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

The user isn't asked for their current password. If the setting isn't enabled or a supported passwordless method isn't available to the user, they must use another available password change or reset option.

Important
In a hybrid environment, password changes made with passwordless authentication can be written back to an on-premises directory when password writeback is configured.

Where the new password is stored depends on the identity environment:

Cloud-only tenant: The password is updated in Microsoft Entra ID.
Hybrid tenant with password writeback enabled: The password is updated in Microsoft Entra ID and written back to Active Directory.
On-premises-only environment: My Sign-Ins can't manage identities that don't exist in Microsoft Entra ID.

@@ -92,8 +92,11 @@ To change their password, an eligible user completes these steps:  The user isn't asked for their current password. If the setting isn't enabled or a supported passwordless method isn't available to the user, they must use another available password change or reset option. -> [!IMPORTANT]-> In a hybrid environment, password changes made with passwordless authentication can be written back to an on-premises directory when password writeback is configured.+Where the new password is stored depends on the identity environment:++* **Cloud-only tenant:** The password is updated in Microsoft Entra ID.+* **Hybrid tenant with password writeback enabled:** The password is updated in Microsoft Entra ID and written back to Active Directory.+* **On-premises-only environment:** My Sign-Ins can't manage identities that don't exist in Microsoft Entra ID.  ---