how would you like to reduce the cost of your i.t department
how about reducing the number of help desk calls by 20 to 50
does that sound like a good thing of course it does who wouldn't want to do that but
with today's topic we're going to do exactly that and it's only going to take a few minutes
i'm Dean Cefola and this is the azure academy the forester research firm
did a study where they showed that the help desk call to do a password reset is on average
about 70 and then gartner did a study that said 20 to 50 percent of help desk calls have to do with
resetting passwords so if we can eliminate the need for your help desk or it staff to do that
work and put it back on the users themselves you can save a lot of time and money so let's enable
azure active directory self-service password reset now in a previous video in our azure ad
series we talked about azure ad domain services and one of the things that we enabled was password
right back now this is just a feature inside azure ad connect then you can reset your passwords in
the cloud and have those passwords be written back to active directory so that's a prerequisite for
this feature to work and you also need appropriate azure ad licensing to use this on your traditional
ad accounts so over here in the azure portal we're in azure active directory and if we scroll down on
the left we can see password reset and the first option at the top is do we want to enable this for
all or for just the selected group so i'm going to just choose selected at this point because i'm
just testing the feature and when we're ready to go into full production we can switch this to all
i'll just click to select a group and then over in the user picker i'll just select my self-service
password group that i've created in active directory already and loaded that up with test
users and then we'll just hit the save button and now we have to talk about authentication
methods so you have the option of choosing just one or two authentication methods i'll take two
and that'll be authenticating my mobile device as well as answering security questions and for
security questions you can have three to five registration questions and then be prompted
at the time you go to reset for three to five responses so i'm gonna choose five questions
and then three required responses now if we click over here to select our security questions
we've again got some options we can choose the predefined questions which i'll click that and
it's your typical stuff from where were you born mother's maiden name where did you work pets names
etc and if those don't work for you no problem we can also select custom and then add whatever it is
you want and just click the add button and i'll even choose a mix of predefined and custom and
then hit save so next is registration and this is a real simple one it's do you want to require your
users to register yes or no if you choose yes how often will they have to refresh their answers and
register their mobile device by default it's 180 days but you can set this from anything to zero
days to two years next is notifications and this is pretty straightforward do the users get a email
when they reset their password and should an admin get an email if another admin tries to reset their
password i think both of those are good things so we'll select those and let's move on to talk about
customization now this is talking explicitly about a help desk link so when someone goes to reset
their password they'll have a link that they can click on in case they run into further problems
but it is just a url box so you could put whatever you want in there i'm just gonna put the link to
the azure academy youtube channel and then click save so in on-prem integration this is where we're
gonna get some more mileage out of that password right back feature and you can see when i click on
it that it does go through a check to see if that is running in our azure ad connect and if so then
we can use the self service password reset feature to force that to do the password right back back
to our active directory and if you don't want that to happen for some reason you can set that to no
and then there's the second item if a user has tried to log in and they're pretty sure they know
their password but they ended up locking their account for some reason they usually have to call
the help desk and get their account unlocked which is again more calls more money that you can save
by leaving this on yes and then they can use the self-service password reset portal to unlock their
own accounts and if they still can't log in they can still reset their password from the portal
and solve their own problem so really really easy to set this up let's see it in action if you want
to master the azure cloud you can start right now by clicking the subscribe button and the
notification bell so you don't miss anything back in azure active directory we'll go over
to our groups and then i'll just search for my self servers password group and then we'll just
click on that and now what we want to do over on the left hand side is go down to licenses
and then you can see i've already assigned it but i'll click on that license and then the
important thing is that you have at least a p1 license selected and if you have more than that
no big deal so i'll open up a private web browser and go to aka dot ms forward slash sspr setup then
i'll log in with the user our mobile device needs to be set up for authentication first
so we'll click to set it up now just enter your country and phone number and then you can choose
to call me or text me i'll choose text and then in a few seconds you'll get a text verification code
and then just put that in and click verify and then we are good to go so now what we want to do
is set up our security questions so we'll click on the next line and this is just all pretty standard
stuff click the drop down pick a question type in your answer and for the second one here i'll
choose a famous person that i've met i'll put in jeffrey snover give me a comment down below if you
know who jeffrey snover is and if you do click the like button then i'll just fill out all the
rest of the questions here and then we'll just save our answers and then we can click finish
so now we want to actually put this to the test so we're going to go to aka dot ms forward slash
sspr and then you put in your username i'll put in shazam and then fill out the capture code and then
click next and now what do we want to do do we want to just reset our password that's the first
option or the second option will allow us to go through that unlock process i'll just choose the
first option and now we need to put in the same mobile phone number which i'll go ahead and do
that and then push text so i can get my code type in the code now i've got to fill out the questions
that i answered earlier and once i'm ready click next and now i can create a new password
once you're done you click finish and the last thing for today is to show you how you can unlock
those on-prem accounts and here is the user shazam inactive directory and you can see that
his account is currently locked so let's go back to aka dot ms forward slash sspr and then we'll
sign in with shazam's account and then fill out the captcha code once again and this time we'll
choose that second option i know my password but i still can't log in and then it tells you here
exactly what the details are so let's hit next and this is the same process that we just went through
we'll add our phone number click text it'll send us that verification code which you'll put in
and then you click next fill out all the questions appropriately and again if you know who jeffrey
snover is hit that thumbs up and click next and now we should be able to get back into
our account so let's go back to active directory and we can see that shazam is now unlocked and
you are ready to get back to work of course if you still don't know your password then you'll have to
go through the unlock procedure again and then do the password reset procedure since you obviously
don't know what it is but at the end of the day you have stopped 20 to 50 percent of your help
desk calls saving piles of money and now you can invest more of your budget into azure workloads
speaking of investing why don't you invest in your azure education by clicking that subscribe
button and the notification bell and you can always catch the latest video right up there
as well as our azure active directory playlist for all the goodies on azure ad and give me some
comments below with your questions or requests for future and i'll see you next week happy learning