Configuration guide: Proactive password reset - Microsoft Teams
The configuration options on this page are only accessible to administrators.
Refer to the Usage guide: Proactive password reset - Microsoft Teams to use library content as a standard user.
Prerequisites
This library pack contains content from the following expansion products
Some of these products offer default access to their respective content and can still be used without expansion products.
To learn more about default thresholds for expansion products, visit the extended documentation.
Included content and dependencies
This library pack contains the following content and dependencies:
Proactive password reset orchestration
Workflow to orchestrate a more powerful password reset process.
Invoke proactive password reset
Checks password expiration date and if it is within the time frame provided by the input parameter, runs a campaign to warn the employee (providing link to reset the password).
Get password expiry for Entra ID endpoints
This remote action is designed for use with endpoints that are Entra ID joined (full Microsoft cloud attached scenarios) and should be executed from a Nexthink Flow.
Configuring Proactive password reset - Microsoft Teams pack
Adapt these suggested configuration steps to edit and customize content according to your organizational needs.
Follow these steps to install and configure content:
Before configuration - Install library pack content from Nexthink Library
Step 1 - Configure Microsoft Teams communication channel
This workflow uses Microsoft Teams messages as the communication channel with end users, which is called a Message thinklet. To learn more about the Message thinklet, see the documentation.
For the Message thinklets to work correctly in this workflow, please complete the configuration steps described on this documentation page.
Step 2 - Set up a registered Microsoft Entra ID app and configure Microsoft Graph API connector credentials
Refer to the following documentation page to register the Microsoft Entra ID application and configure the appropriate connector credentials in Nexthink: Entra ID integration for workflows.
For this workflow, the registered Entra ID application must be granted the following permissions:
Application or Delegated
User.Read.All
Directory.Read.All
Mail.Send
This workflow has been tested using the Application permission type. Different environments require different permissions. You should assign permissions according to your environment and know the risks involved.
Refer to the Graph REST API documentation from Microsoft for more information.
Step 3 -Configure global parameters
There are two global parameters in this workflow:
3.1 - Password expiration policy in days (password_expiration_policy_in_days)
This parameter contains the password expiration policy in days; for example, in how many days the password must be changed or it will expire. Below is the default value of this parameter:
Password expiration policy in days
60
The number of days until user passwords expire, as defined by your organization. This value can usually be found in your organisation's password policy.
3.2 - Reminder threshold (reminder_threshold)
This parameter contains the number of days before the password expires that the user should be notified of the upcoming password expiration. Below is the default value of this parameter:
Reminder threshold
30
The number of days before user passwords expire when users must be notified to change their passwords. If the number of days before the user's password expiration is less than the number defined in this parameter, the user will receive a Teams message with a reminder to change the password.
Step 4 - Configure remote actions
This workflow uses the following remote actions. Make sure to install the latest versions and complete the setup as below.
Invoke proactive password reset
API trigger should be enabled so that it can be triggered from the Workflow
The following RA input parameters will be overridden by workflow parameters and must have the 'Allow user to enter custom values' option enabled:
CampaignId
DaysUntilExpiration
PasswordExpirationPolicyInDays
Get password expiry for Entra ID endpoints
API trigger should be enabled so that it can be triggered from the Workflow
The following RA input parameters will be overridden by workflow parameters and must have the 'Allow user to enter custom values' option enabled:
pw_reset_threshold
last_password_change_date_time
reminder_threshold
Invoke proactive password reset - Input parameters
CampaignId
This parameter must be empty because this workflow uses Microsoft Teams as the communication channel, not campaigns.
NQL ID of the campaign to notify the user that the password is about to expire and to provide the URL to reset it.
DaysUntilExpiration
This input parameter will be overridden by workflow parameters and must have the Allow user to enter custom values option enabled.
Number of days left for the password to expire. If expiration date is inside this time frame, the campaign is run.
MaximumDelayInSeconds
60
Maximum random delay set to avoid domain controller overload. Provide number of seconds less than 600.
PasswordExpirationPolicyInDays
This input parameter will be overridden by workflow parameters and must have the Allow user to enter custom values option enabled.
Number of days for the password to expire since it is set.
Get password expiry for Entra ID endpoints - Input parameters
pw_reset_threshold
This input parameter will be overridden by workflow parameters and must have the Allow user to enter custom values option enabled.
This value should match the password reset policy value in days which is set in Entra ID. It must be provided to perform the calculation.
last_password_change_date_time
This input parameter will be overridden by workflow parameters and must have the Allow user to enter custom values option enabled.
The date and time that the password was last reset which is provided using the API widget contained in the Nexthink Flow.
reminder_threshold
This input parameter will be overridden by workflow parameters and must have the Allow user to enter custom values option enabled.
This input value is the expiry countdown (number of days) at which you would like the user to begin being prompted to perform a password reset. When the threshold is active the user will be reminded on each Flow execution.
RELATED TOPICS
Last updated
Was this helpful?
