Overview

The Microsoft Entra Password Reset Agent template creates an AI Agent that works as a first-line IT help desk for work-password problems. A caller says they cannot sign in, the agent verifies who they are, and then helps them reset their Microsoft 365 (Entra) work password without a human on the line. Anything it cannot handle is transferred to your support team.

The agent never sees, chooses or speaks a password. It orchestrates secure tools that talk to Microsoft; Microsoft and the Calldacity server do the sensitive work.

How a Call Goes

1. Greeting. The agent greets the caller. If they need a password reset or cannot sign in because of a password, it moves straight to the reset step. If they ask for a person or department, it transfers them. It can also answer basic company questions.
2. Work email. The agent asks, "What's your work email address? Could you spell it out for me?" It converts spoken letters into an address, reads the part before the @ back letter by letter, and asks the caller to confirm. It allows two corrections.
3. Find the account. The agent looks up the account in your Microsoft directory and asks the caller to confirm the display name. If no account is found after a second try, or the name is not theirs, the call is transferred to a person.
4. Choose a method. If the account has both a registered mobile number and a recovery email, the agent asks whether the caller prefers a text or an email. The agent never asks for a number or address to send to: it only uses the recovery methods already registered on the account, and only reads back masked versions (for example, "mobile ending in 55").
5. Verify (if two-factor is on). A 6-digit code is sent to the registered method and the caller reads it back. A wrong code can be retried a few times; after that the call is transferred. Codes expire after a few minutes.
6. Reset. Depending on your settings, the caller receives either Microsoft's official self-service reset link or a temporary password, sent to the registered method. In both cases the caller sets a new password at their next sign-in. With a temporary password, their other sessions are signed out.
7. Wrap up. The agent asks if there is anything else, then ends the call.

What You Need Before You Start

• A Microsoft 365 tenant with Entra ID and a person who can grant admin consent (a Global Administrator or equivalent).
• Employees whose accounts have a recovery phone or recovery email registered in Microsoft. Accounts with no registered method cannot be helped by the agent and are transferred.
• Self-service password reset (SSPR) enabled for the people who will use this. [VERIFY IN UI: whether this is required for every mode]
• A sender mailbox that exists in your Microsoft 365 tenant, for example noreply@yourcompany.com (a free shared mailbox works). Without one, reset emails are sent from the employee's own mailbox, which fails for people without an Exchange mailbox.
• A phone extension or number for your IT team, so failed calls transfer to a person.

Permissions the Admin Must Grant

When you select Connect with OAuth a one-time Microsoft consent screen opens. Calldacity asks for application permissions (it works on its own without a signed-in user), so a Microsoft administrator has to approve them:

You can review and revoke the consent at any time in your Microsoft Entra admin center, under Enterprise applications. [VERIFY IN UI: app name shown on the consent screen]

Create the Agent

1. Open the AI Agent module and choose to add a new agent. In the creation choices, pick start from a template and select Microsoft Entra Password Reset Agent. [Screenshot: template picker] [VERIFY IN UI: template card name and description]
2. Continue to the Add AI Agent form. Fill in the agent name and the usual details. [VERIFY IN UI: the template's extra questions]
3. If the form shows the two reset questions, set them (see "Choose Your Safety Settings" below).
4. Create the agent.

Connect Your Microsoft Tenant

1. Open the new agent and go to the Actions tab. Find the Microsoft Entra password-reset connection (Microsoft Entra, Password Reset Assist) and open its configuration. [Screenshot: Entra configuration]
2. Read the notice One-time admin consent required, then select Connect with OAuth.
3. Sign in with a Microsoft administrator account and approve the permissions listed above.
4. Enter the Sender mailbox (optional). Although optional, set it. It applies to all AI agents in this domain that use this Microsoft tenant.
5. Choose the safety settings below and save. Turn the connection on if it is shown as disabled.
6. Use the connection's test and tool list to confirm three tools are available: find user, trigger password reset, and verify and reset. [VERIFY IN UI: test labels]

Choose Your Safety Settings

With both left at their defaults, the caller verifies with a code and then receives Microsoft's official reset link, and completes the reset in Microsoft's own page.

Safety Considerations

• The agent never handles secrets. It does not see or say verification codes, temporary passwords, full phone numbers or links. It only reads masked destinations.
• The destination is never chosen by the caller. Messages always go to the recovery methods registered in your directory. This stops someone redirecting a reset to their own phone.
• The agent cannot weaken your settings. Whether verification is required is decided on the server from your configuration, not by the conversation.
• Limited retries and cooldowns. Wrong codes lock out after a few attempts and the caller is transferred. Repeated requests within a few minutes are not resent.
• Disabled accounts and accounts with no recovery method are transferred without explaining why.
• Calls are recorded and transcribed according to your agent settings. Codes and passwords are not spoken, so they should not appear in transcripts.
• Keep 2FA verification on, and use a dedicated shared sender mailbox. Review who can edit this agent, since changing the settings changes how strongly callers are verified.
• Recovery contact details should be kept current; an employee who has lost access to their registered phone and email cannot use this agent and needs your IT team.

Test Before Going Live

1. Use a test employee account with a registered mobile or recovery email you control.
2. Place a test call using the AI Agent tester or a real phone. See: AI Agent Tester | Scenarios, Suites and Batch Runs.
3. Try the unhappy paths: a misspelled email, a wrong code, an account with no recovery method, and asking for a person. Each should end calmly or transfer.

Troubleshooting

• "Could not deliver" or the agent says it cannot send the link. The sender mailbox is probably missing or does not exist. Set Sender mailbox to a real mailbox in your tenant.
• The agent cannot find anyone. The consent was not granted, or it was granted for a different Microsoft tenant. Reconnect with OAuth as an administrator of the right tenant.
• Everything is transferred. Check the connection is enabled and the transfer destination is set for the agent.
• Temporary password option does not work. The additional permission and role have not been granted.

Related Articles

• AI Agent | In Call Action | Connecting MCP Servers, Choosing Tools and Setting Tool Overrides
• AI Agent Tester | Scenarios, Suites and Batch Runs
• Building Conversation Flows
• Call Routing Rules (Flow State)