Information
Ensure that users are notified on their primary and secondary emails on password resets.
Rationale:
User notification on password reset is a proactive way of confirming password reset activity. It helps the user to recognize unauthorized password reset activities.
Impact:
Users will receive emails alerting them to password changes to both their primary and secondary emails.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
From Azure Portal
From Azure Home select the Portal Menu
Select Microsoft Entra ID
Select Users
Select Password reset
Under Manage, select Notifications
Set Notify users on password resets? to Yes
Default Value:
By default, Notify users on password resets? is set to 'Yes'.