Self Service Password Reset ( SSPR)
Overview
Self-Service Password Reset (SSPR) allows end users to securely reset their passwords without direct MSP intervention, while preserving MSP control for high-risk recovery scenarios. This release improves security, reduces help desk workload, and standardizes password management across all supported directory integrations.
Prerequisites for Self-Service Password Reset (SSPR)
There is no additional licensing required to use Self-Service Password Reset (SSPR). Access is managed through the Evo Policy system. Before SSPR can be made available to end users, ensure the following requirements are met:
- Policy Configuration Enabled The Self-Service Password Reset setting must be added to either the Global Policy or a specific policy. That policy must also be assigned an appropriate scope (Environment, Tenant, or Directory). Note: SSPR is not enabled by default.
- Password Sync Must Be Enabled All directories included within the scope of the SSPR policy must have Sync Passwords Back to Provider enabled. If this setting is not configured, the system will detect it and prompt the administrator to enable it before allowing the policy to be saved.
- User Email Requirement Each user must have a valid email address configured on their account in order to use SSPR.
Supported Password Reset Flows
User-Initiated (Logged In)
Users can reset their password while signed in to the Evo Portal:
- Partner Portal
- Path: Profile → Account Details
- User Portal
- Path: Settings
Evo Mobile App
- Path: Settings → Password Reset
Flow:
- User initiates reset from mobile app
- Answers Security Questions
- Sets new password
Evo Admin Assisted
MSPs can initiate password resets via:
- Desired Tenant → Identities → Users → Desired User→ Password Reset tile
- Choose Delivery Method
- Option to override additional challenge ( If enabled via Policy )
Important Behavior Changes
Administrator-Controlled “Forgot Password”
- The Forgot Password option is now disabled for end users when SSPR is enabled
- Administrators retain full access to Forgot Password workflows
- Locked-out users must contact the MSP help desk for assistance
Note: This change reduces exposure to external password reset abuse and ensures human-verified recovery when risk is highest.
Password Reset Limits
- Maximum: 3 reset attempts per user per hour
- Lockout can be cleared by Evo Admins under the users account under Identities → Users
- Attempts reset automatically after 24 hours
New Policies that come with Self-Service Password Reset (SSPR)
Self-Service Password Reset: Controls self-service password reset and any additional challenge requirements.
This policy enables SSPR functionality Must be: Assigned a scope, OR Included in the Global Policy
Additional Controls: Ability to require additional authentication challenges during reset
Passwords Remembered: Number of previous passwords a user cannot reuse.
Default: 5 previous passwords Maximum: 24 Set to 0 to disable enforcement
This policy applies even without SSPR enabled.
Password complexity rule: Password complexity requirements such as length and character classes.
Configurable requirements include:
- Minimum length
- Maximum length
- Banned password terms
Supported Rules:
- At least one digit
- At least one uppercase letter
- At least one lowercase letter
- At least one special character
- Minimum length requirement
- Maximum length limit
- Cannot contain user-specific information
Maximum Length by Directory:
- Azure / Entra / LDAP: 256 characters
- Google Workspace / Evo Cloud: 100 characters
Key Takeaways for Partners
- SSPR reduces ticket volume but still keeps MSPs in control for edge cases
- Strong policy controls ensure security is not compromised
- Help desk-assisted flows remain available and enhanced
- All Directory integrations now support password write-back (when enabled)