Detections
Analytics

5.2.4.4 Ensure that users are notified on password resets

Information

This setting determines whether or not users receive an email to their primary and alternate email addresses notifying them when their own password has been reset via the Self-Service Password Reset portal.

The recommended state is Notify users on password resets? is set to Yes.

User notification on password reset is a proactive way of confirming password reset activity. It helps the user to recognize unauthorized password reset activities.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate using the UI:

 - Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
 - Expand Entra ID > Password reset and select Notifications.
 - Set Notify users on password resets? to Yes
 - Click Save.

Impact:

Users will receive emails alerting them to password changes to both their primary and alternate emails.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5

Plugin: microsoft_azure

Control ID: 3b274cf221a6e599af5811c89160f0b3e5447e7ccc631f1dc67374e4b08b91f0