AI-Powered Password Reset: Reducing Help Desk Volume by Eliminating the #1 Ticket

Password resets handled entirely by self-service give your team instant recovery at any hour and give whoever runs IT a queue free of its most common ticket. Three moves get you there:

• Turn on self-service password reset in your identity provider (Microsoft Entra ID or Google Workspace)
• Require recovery-method registration so every employee can actually use it
• Add a deflection rule in your help desk that answers the reset requests that still arrive as tickets

Verified against Microsoft Entra ID self-service password reset and Google Workspace account recovery on 2026-07-26.

Prerequisites

• Microsoft shops: a Microsoft Entra ID P1 license and an account with at least the Authentication Policy Administrator role
• Google shops: super administrator access. Self-service recovery is not available if you sign in through a third-party SSO provider or use Password Sync
• Optional deflection layer: a help desk with automation rules. This guide uses Jira Service Management; the same pattern works in Zendesk and Freshservice

Step 1: Turn On Self-Service Reset in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Entra ID → Password reset.
3. On the Properties page, under Self service password reset enabled, choose Selected and pick a pilot group. Select Save. Move the setting to All once the pilot runs cleanly.
4. On the Authentication methods page, set Number of methods required to reset to 2 and enable Mobile app notification, Mobile app code, Email, and Mobile phone. Select Save.
5. On the Registration page, set Require users to register when signing in to Yes and leave the reconfirmation window at 180 days. Select Save.

Employees register their methods at the next sign-in, or directly at aka.ms/ssprsetup. From then on, a locked-out user resets at aka.ms/sspr instead of filing a ticket.

Step 2: Turn On Account Recovery in Google Workspace

Skip this step if you run on Entra ID.

1. In the Google Admin console, go to Menu → Security → Authentication → Account recovery. You must be signed in as a super administrator.
2. Click User account recovery.
3. Turn on Allow users and non-super admins to recover their account, then click Save.
4. Ask employees to add a recovery phone number or email address in their Google Account settings. Anyone with 2-Step Verification enabled needs a recovery email address specifically.

Users without recovery information on file are directed to contact an administrator, so pair the setting change with a short announcement asking everyone to register.

Step 3: Add an AI Deflection Rule in Your Help Desk

Some reset requests will still arrive as tickets, usually phrased as "can't log in" rather than "password reset." A deflection rule closes the loop:

1. In your service project, open Project settings → Automation and select Create rule.
2. Choose the trigger When: Work item created, with a condition matching password and lockout phrasing in the summary or description.
3. Add the action Comment on work item with the reset portal link for your identity provider and a one-line instruction.
4. Add the action Edit work item to set the ticket to a waiting status, then name the rule and select Turn it on.

Keyword conditions catch the obvious phrasings. An AI classification pass catches the rest: our guide to using Claude to triage IT requests shows how to have Claude read every new ticket, and a category of access fed by that setup makes this deflection rule far more accurate than keywords alone.

Verify

• Register a test user's methods at aka.ms/ssprsetup, then complete a reset at aka.ms/sspr and confirm the notification email arrives. On Google, use Forgot password? on the sign-in page with a test account that has recovery information.
• File a test ticket reading "locked out of my laptop, need a password reset" and confirm the deflection comment appears within seconds.
• After two weeks, count reset tickets in the queue. The remaining ones should be genuine edge cases.

Troubleshooting

Google users still get "contact your administrator": They have no recovery phone or email registered, or your organization signs in through SSO or Password Sync, where the setting does not apply.

Entra users are never prompted to register: They are not in the group you selected on the Properties page, or they already dismissed the one-time registration interrupt for that session. Send the direct link instead.

Reset tickets keep arriving anyway: People ask where they always asked. Announce the self-service portal in the channels where reset requests currently show up, and let the deflection rule handle stragglers.

Reclaim the Hours

Self-service reset is worth configuring for scale from day one, and if your team has been resetting passwords by hand for years, it is not too late to switch it off as a manual duty. ScaleIt builds this into managed IT for startups and SMBs, from the identity provider settings to the AI deflection layer. Book a free call and we will map it to your stack this month.

Verified against Microsoft Entra ID self-service password reset and Google Workspace account recovery on 2026-07-26. Vendor docs: learn.microsoft.com/entra, support.google.com/a.