Reset-EntraUserMFAAndPassword

A PowerShell script that bulk-resets MFA authentication methods and passwords for Microsoft Entra ID (Azure AD) users, driven by a single JSON configuration file.

---

Features

• Reads users and all settings from one JSON config file
• Removes all registered MFA methods per user (Authenticator app, phone, FIDO2 key, Windows Hello, software OATH token, email OTP, Temporary Access Pass)
• Generates a cryptographically random password per user
• Optionally forces a password change at next sign-in
• Outputs a timestamped CSV report with the result and new password for each user
• Supports -WhatIf for a dry run before making any changes

---

Prerequisites

PowerShell module

Install-Module Microsoft.Graph -Scope CurrentUser

Microsoft Graph API permissions

The account or service principal used to connect needs the following delegated or application permissions:

Permission	Purpose
UserAuthenticationMethod.ReadWrite.All	Read and delete MFA authentication methods
User.ReadWrite.All	Reset user passwords

---

Files

ResetUsers/
├── Reset-EntraUserMFAAndPassword.ps1   # Main script
├── reset-config.json                   # Configuration + user list
└── reports/                            # Created automatically; contains CSV reports

---

Configuration (reset-config.json)

{
  "tenantId": "your-tenant-id-here",
  "passwordLength": 16,
  "forceChangePasswordNextSignIn": true,
  "reportFolder": "./reports",
  "users": [
    { "userPrincipalName": "user1@contoso.com" },
    { "userPrincipalName": "user2@contoso.com" }
  ]
}

Fields

Field	Required	Default	Description
tenantId	No	Signed-in default	Entra ID tenant ID or domain (e.g. contoso.onmicrosoft.com). Omit to use the tenant of the signed-in account.
passwordLength	No	16	Length of the generated password. Minimum 8.
forceChangePasswordNextSignIn	No	true	Whether the user must change the password on first sign-in.
reportFolder	No	Script directory	Folder where the CSV report is saved. Supports relative paths (relative to the script). The folder is created automatically if it does not exist.
users	Yes	—	Array of user objects. Each object must have a userPrincipalName property.

---

Usage

Normal run

.\Reset-EntraUserMFAAndPassword.ps1

Reads reset-config.json from the same folder as the script.

Custom config file

.\Reset-EntraUserMFAAndPassword.ps1 -ConfigFile .\other-config.json

Dry run (no changes made)

.\Reset-EntraUserMFAAndPassword.ps1 -WhatIf

Shows exactly what would happen for each user without touching anything in Entra ID.

Verbose output

.\Reset-EntraUserMFAAndPassword.ps1 -Verbose

Prints each individual authentication method that is removed.

---

Report output

After the script finishes, a CSV report is saved to the configured reportFolder with the filename pattern:

Reset-Report_YYYYMMDD_HHmmss.csv

Columns

Column	Description
UserPrincipalName	The UPN of the processed user
MFAReset	Success, Failed, or Skipped
PasswordReset	Success, Failed, or Skipped
NewPassword	The newly generated password (empty on failure)
Error	Error message if something went wrong
Timestamp	Date and time the user was processed

Important: The report file contains plaintext passwords. Store it securely and delete it once you have distributed the credentials to the users.

---

How it works

1. The script reads and validates reset-config.json.
2. It connects to Microsoft Graph with the required scopes (an interactive browser sign-in prompt appears).
3. For each user in the list:
   • It verifies the user exists in Entra ID.
   • It retrieves all registered authentication methods and deletes each supported type.
   • It generates a random password and calls the Graph API to set it.
4. Results are collected and exported to a CSV report.
5. The Graph session is disconnected.

---

Security considerations

• Run this script only with an account that has the minimum required permissions.
• The generated report contains plaintext passwords — treat it as sensitive data.
• Consider using -WhatIf first on any production tenant.
• Do not commit reset-config.json or report files to source control if they contain real UPNs or passwords. Add them to .gitignore:

reset-config.json
reports/