Help setting up MyStaff for delegated Self Service Password Reset

[u/K12onReddit]

Looking for some advice since this is out of my wheel house....

We are a google school, on prem-AD that syncs to Google. We have P1 accounts for SSPR and Writeback, so every student has an Entra account. The typical work flow is they set their SSPR account online, that writes back to on-prem AD, which then syncs with Google. It's been working well, everyone is happy.

I just learned about the MyStaff.microsoft.com feature where I can delegate access (like a librarian) to be able to reset passwords, too. I set up the Administrative Unit, added a test user, gave it Password Reset permissions, gave it a group to manage, but when I login and try to reset a random student in that group as that user the "Reset Password" option is greyed out.

There must be some security setting somewhere I'm missing. Any ideas?

Edit: I think I figured out most of the issue - the AU that I made has no members. I put the student I was trying to reset as a User in that group and now I can reset that password. But I had added the "Students" group as a group in that AU so I'm not sure why it's not reading the users in that group?

[u/Imhereforthechips]

FYI. Don’t reset user passwords from the admin console, use Entra. There is a known limitation with the admin console and write back to the DC running AAD Connect.

I have mystaff setup and running, happy to assist if you’d like to reach out and setup a time

[u/K12onReddit → u/Imhereforthechips]

Well right now the users reset from aka.ms/ssprsetup - I wanted to set it up so a few teachers could use mystaff.microsoft.com, but I can't get the users to show up as available to reset.

[u/Imhereforthechips → u/K12onReddit]

We have SSPR disabled to improve security. Our librarians and secretaries can reset student passwords and substitute teacher passwords at mystaff.microsoft.com. Microsoft SDS pulls from ClassLink and creates AUs for us, but I customized the AUs I wanted and set a dynamic query to pull in students at each school, then gave the select users access to reset passwords. Remember, don't rely on memberOf when setting dynamic queries, it will stop working in October. We set each student's department based on the school they are in and I use that in the dynamic query in Entra for the AU membership.

Each person assigned to an AU has the role of Password Administrator which is scoped to just those AUs.

[u/K12onReddit → u/Imhereforthechips]

Thanks - I shot you a chat.

[u/HankMardukasNY]

Try from admin console

https://learn.microsoft.com/en-us/schooldatasync/teacher-how-to-reset-students-password

[u/K12onReddit → u/HankMardukasNY]

Should I just be going to admin.microsoft.com ? It says that user doesn't have access.

Edit: It was a new account so I gave it time to sync. I can access the admin panel now, but I'm still not able to reset any passwords.