> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Reset a password

By default, if users forget the password they use to access IDaaS or an application, they must contact an account administrator to reset it.

You can enable password reset to allow users to reset their password without contacting an administrator. When enabled, a **Forgot your password?** link appears on the sign-in page. When users click this link, they are prompted for their username and second-factor credentials. If both are valid, they are prompted to create a new password.

Password reset is an account recovery flow. Before you enable it broadly, review the allowed second-factor authenticators, group scope, and resource rules. For planning guidance, see [Account recovery and authenticator readiness](/docs/authentication-and-security/manage-authenticators/account-recovery-and-authenticator-readiness.md).

Password reset is supported when logging in to the following:

- IDaaS
- OIDC and OAuth applications
- SAML applications
- Active Directory

note

- Password reset cannot be performed when logging in to RADIUS or Entrust Identity Enterprise applications.
- Password reset is not available in the Entrust Identity app if the Soft Token PIN policy in IDaaS is set to `false` (disabled). See the setting, **PIN Required** **in** [Modify Entrust Soft Token (ST) authenticator settings](/docs/authentication-and-security/manage-authenticators/manage-soft-token-authenticators/modify-entrust-st-authenticator-settings.md).

### Prerequisites

Configure the following settings of your IDaaS account to enable password reset:

- **Enable password reset.** See [Enable password reset](/docs/authentication-and-security/manage-authenticators/manage-password-reset/enable-password-reset.md).
- **Set Authentication Decisions.** Set **first-factor** to password in the Resource Rule **Authentication Decision** settings (see [Create and manage resource rules](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules.md)).
- **Assign password reset groups to users.** If you have configured the **Password Reset Settings** of your account to require users to be part of specific groups, assign those groups to users accordingly (see [Add users to IDaaS](/docs/people-and-access/manage-members/add-users-to-identity-as-a-service/add-users.md)).
- **Assign required second-factor authenticators to users.** If you configured an additional second-factor for password reset, users must have at least one authenticator from the **Second-factor Authenticators Allowed** list to perform a Password Reset before they can reset their password (see [Manage and assign user authenticators](/docs/authentication-and-security/manage-authenticators.md)).

## Active Directory password reset

You can customize your account settings to let users reset their Active Directory password. This is useful when users need to complete password authentication but have forgotten their Active Directory password. For setup steps, see [Enable password reset](/docs/authentication-and-security/manage-authenticators/manage-password-reset/enable-password-reset.md).

### Requirements

Active Directory password reset only works under the following conditions:

- You are using Active Directory DS or Active Directory LDS with native users.
- The IDaaS directory configuration that syncs Active Directory users to your IDaaS account is configured with SSL and with an Active Directory administrator that can reset passwords. The administrator is allowed to modify the following attributes:
  - `unicodePwd`
  - `lockoutTimeout`
  - `pwdLastSet`

### Limitations

The **Minimum Lifetime** (Minimum password age in Active Directory) is not enforced during a password reset.

### Reset a password using a link

A password reset URL is available at `/#/reset/<userID>` where **userID** is optional.

For example, if the User ID is `aliceg`, then the password reset link would be `mycorp.<region>.trustedauth.com/#/reset/aliceg`

- If set, **userID** lets users skip entering their username and go directly to the password reset flow.
- If users open the reset URL while already signed in, they are signed out and redirected to the password reset flow.
- If an invalid userID is provided, an error message appears and users are prompted to enter their username.
- If users click **Cancel** during the password reset flow, they are redirected to `/#/reset`.
- If users cannot reset their password during the flow, they are redirected to the sign-in page.