Forum Discussion

Jakob Rohde's avatar
Jakob Rohde
Copper Contributor
Mar 23, 2017
Solved

How do guest users change passwords?

Hi   The title says it all - I have been searching for a detailed description of how guest users change their passwords.   Are the guest user account somehow tied to their on-prem AD account so i...
Azure AD B2B
  • Sarat Subramaniam's avatar
    Sarat Subramaniam
    Apr 04, 2017

    Thanks for the question Jakob - and your response Joe.

     

    Here are the details about SSPR for the B2B user that is invited to a resource tenancy from their identity tenancy:

     

    1. SSPR will happen only in the identity tenancy of the B2B user
      1. If the identity tenancy is MSA – uses the MSA SSPR mechanism
      2. If the identity tenancy is a JIT/Viral tenancy, a password reset email will be sent
      3. For others, the standard SSPR process will be followed for B2B users, similar to members

     SSPR for B2B users in the context of the resource tenancy will be blocked.

     

    Hope this helps. 

     

    Please try this out and let us know if you have any issues!

Joe McNicholas's avatar
Joe McNicholas
Brass Contributor
Mar 27, 2017

Hi Jakob

 

The guest users are "by design" not full users in your Azure AD, and you don't hold their password.  Their representation in the Azure AD is just a sort of "link" back to their real account.  As such, the users come from other sources like 

 

- Their own Office 365 tenant

- A "just in time" tenant (for users who don't have an MS account of any sort)

- A Microsoft account

 

When they use your resources as guests, they are authenticated back to their source directory, not your Azure AD.  So, the user must manage/chnage the password in their source environment.

 

Thanks

Joe

Sarat Subramaniam's avatar
Sarat Subramaniam
Icon for Microsoft rankMicrosoft
Apr 04, 2017

Thanks for the question Jakob - and your response Joe.

 

Here are the details about SSPR for the B2B user that is invited to a resource tenancy from their identity tenancy:

 

  1. SSPR will happen only in the identity tenancy of the B2B user
    1. If the identity tenancy is MSA – uses the MSA SSPR mechanism
    2. If the identity tenancy is a JIT/Viral tenancy, a password reset email will be sent
    3. For others, the standard SSPR process will be followed for B2B users, similar to members

 SSPR for B2B users in the context of the resource tenancy will be blocked.

 

Hope this helps. 

 

Please try this out and let us know if you have any issues!