User Initiated Password Reset in Azure AD

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

Detects when a user successfully resets their own password within Azure Active Directory. This rule specifically looks for 'UserManagement' category events with a 'Success' status, initiated by a 'UPN' (User Principal Name) and targeting a 'UPN' with an 'ActivityType' containing 'Password reset'.