Entra External ID: Password reset form accepts mismatched passwords when new password field is modified after confirm field

Haha, AI saying this is ok almost.

I think thats a terrible end user experience and should be fixed.

This behavior is a client-side validation bug in the password reset UX, not the server-side password policy.

From the documented flow, password reset is ultimately validated only when the new password is submitted to Microsoft Entra ID. At that point, the service evaluates the password against:

• Banned password checks and fuzzy matching
• On-premises password policies (for writeback scenarios)

If the submitted password is invalid according to these rules, the reset fails and an error such as “Password doesn't comply with fuzzy policy” or “On-premises policy violation” is returned. However, the documentation does not define or guarantee any specific client-side behavior for comparing the “new password” and “confirm password” fields; that logic is implemented in the UI layer.

Because the server accepts a single password value, the mismatch between the two fields in the browser does not affect the backend validation. The form should block submission when the fields differ, but if it does not, the backend will still only store the value actually sent as the new password and then apply its normal strength/banned-password checks.

Recommended actions:

1. Treat this as a UI defect in the Entra External ID password reset experience and report it through the official support channel for Entra External ID so it can be fixed in the front-end validation logic.
2. If building a custom password reset experience (for example, using native authentication SDKs), ensure the application performs its own client-side check that the “new password” and “confirm password” fields match before calling the reset API, and then still handle server-side errors such as isInvalidPassword() / isPasswordResetFailed().

The server-side password evaluation and SSPR flows remain governed by the documented password protection and SSPR rules; this issue is limited to the front-end form not enforcing a match between the two fields before submission.

References:

• Eliminate bad passwords using Microsoft Entra Password Protection
• How it works: Microsoft Entra self-service password reset
• Troubleshoot self-service password reset in Microsoft Entra ID
• Tutorial: Add self-service password reset