---
title: Overview
slug: ti3t-overview
createdAt: 2025-11-06T00:27:34.262Z
---

The **Activate Self Service Password Reset (SSPR) Manager** provides users with a secure, streamlined method to reset their own passwords without administrative assistance.
 It integrates directly with the organization’s **Active Directory (AD)** or **Entra ID** environment, ensuring compliance with corporate password policies and maintaining enterprise-level security.

## Overview

Activate’s SSPR Manager enables users to recover or change their passwords through a guided web interface.
 It supports **multi-factor verification** and can be accessed both internally and externally via **Activate Anywhere**, offering full support for remote or hybrid users.

## Key Features

### Identity Verification

Supports configurable challenge-response questions, SMS or email one-time passcodes (OTP), and integration with corporate MFA solutions.

### Policy Enforcement

Automatically aligns password complexity and expiry rules with the organization’s AD or Entra ID policies.

### Secure Access Boundary

When accessed externally, all communication routes through **Activate Anywhere**, ensuring password resets occur over a secure, authenticated channel.

### Audit and Logging

All password reset attempts are recorded in the **Activate event log** for compliance, monitoring, and traceability.

### Administrator Control

Administrators can:

- Define and enforce password reset policies. 
- Enable or disable the SSPR feature for specific roles. 
- Review reset history and audit logs in **Activate Studio**. 

## Typical Workflow

1. The user navigates to the **password reset page** on the Activate or Anywhere site. 
2. The system validates the user’s identity using the configured verification method. 
3. The user sets a new password that complies with policy requirements. 
4. The password change is written directly to AD or Entra ID and logged for audit purposes. 

## Benefits

- Reduces helpdesk workload and response times. 
- Provides secure, compliant password recovery for remote and hybrid workforces. 
- Enhances user experience while maintaining enterprise-grade security controls. 

## Security Overview

### General Security

- Secret answers are encrypted and stored securely in the Activate SQL database. 
- Security questions are configurable and should avoid personal or easily guessable content. 
- Options available for configuration: 
  - Number of questions required for registration or reset. 
  - Minimum answer length (default: 3 characters). 
- User registration status is recorded in **Active Directory’s extensionAttribute1**. 

**Example AD Attribute Data stored in extensionAttribute1**

```xml
<?xml version="1.0" encoding="utf-16"?>
<user>
  <password>
    <answers set="1" when="2013-08-29T10:52:57" />
  </password>
</user>
```

## Security Features (Immutable)

- Answers cannot be blank.&#x20;
- All answers must be unique.&#x20;
- Case-insensitive matching is enforced.&#x20;

Do not modify or override these immutable security rules. They are designed to preserve the integrity of the password reset system.

## External Password Reset & Credential Provider

- Uses a **REST-based web service** for communication.&#x20;
- **Transport Security:** 256-bit AES encryption for all communication between client and server.&#x20;
- **Logical Security:** Each transaction uses a unique session key to prevent spoofing or replay attacks.&#x20;
- Answers are **never transmitted to the client** during the process, ensuring sensitive data remains protected.