Entra ID SSPR and password writeback errors: SSPR_00xx codes, event IDs and fixes

Self-service password reset (SSPR) fails in two places: on the reset page, where the user gets an SSPR_00xx code, and on the Microsoft Entra Connect server, where password writeback logs what Active Directory did with the new password. This quick reference lists every code and event Microsoft documents for both, with the meaning, the usual cause and the first check, plus the healthy event sequence to look for when you test a fix.

How to read these codes#

• Password reset page (https://passwordreset.microsoftonline.com, reached through https://aka.ms/sspr or the Forgot my password link): the user sees a sentence plus Technical details with the code. Each code also has an internal name such as UserNotLicensed = 12. Ask the user for the code and the Support code GUID at the bottom of the page.
• Application log on the Entra Connect server: two sources matter. PasswordResetService covers the writeback service itself: 31xxx events for each reset and the service's own state (progress and some failures), 32xxx service and connectivity errors, 33xxx Active Directory results. ADSync covers what happened when the sync engine set the password in Active Directory.
• Cloud Sync: users see the same reset page when writeback runs through the provisioning agent; the agent's permissions and version cause most failures (last table).
• Reset or change? A reset means nobody supplied the current password (user or admin); a change means the user typed it. They log different event IDs, so test one operation at a time.

For the full setup walk-through (scope, licensing, writeback permissions), see Self-service password reset and password writeback: fixing the usual failures. Sync errors on the same server are in the Entra Connect sync errors quick reference.

Password reset page codes (SSPR_00xx)#

Registration and usage messages without a code#

Writeback events on the Entra Connect server#

Service and connectivity (31xxx and 32xxx)#

Active Directory results (33xxx)#

ADSync and sync engine messages#

Healthy events (what good looks like)#

• 31001 → 31002: a user reset arrived and was written to AD. 31006 → 31007: the same for a password change. 31009 → 31010: an admin reset on behalf of a user.
• 31004 → 31005: onboarding when you enable writeback, with 31017 (admin token) and 31018 (encryption key) along the way. 31012 → 31013: offboarding.
• 31015: the service started and accepts requests. 31019: a Service Bus heartbeat succeeded; it names the namespace you can test.

Setup and Cloud Sync errors#

Import-Module 'C:\Program Files\Microsoft Azure AD Connect Provisioning Agent\Microsoft.CloudSync.Powershell.dll'
Set-AADCloudSyncPermissions -PermissionType PasswordWriteBack -EACredential (Get-Credential)
Set-AADCloudSyncPasswordWritebackConfiguration -Enable $true -Credential (Get-Credential)

New permissions can take an hour or more to replicate to every object. The trade-offs between both tools are in Cloud Sync vs Connect Sync.

How to verify a fix#

1. Connectivity first. Take the namespace from the latest 31019 or 31034 event and test it. Good: TcpTestSucceeded : True.
   PowerShell

   Test-NetConnection -ComputerName <namespace>.servicebus.windows.net -Port 443

2. Reproduce one operation with a test user in scope, then read the log. Good: 31001 then 31002 (or 31006 then 31007), and no 32xxx, 33xxx or 6329 entries.
   PowerShell

   Get-WinEvent -FilterHashtable @{ LogName = 'Application'; ProviderName = 'PasswordResetService'; StartTime = (Get-Date).AddMinutes(-30) } |
       Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

3. Confirm AD took it: Get-ADUser testuser -Properties PasswordLastSet | Select-Object Name, PasswordLastSet shows the time of the reset.
4. Sign in on-premises and in the cloud with the new password, and restore any password policy you relaxed for testing.

Password change failures shown at sign-in carry AADSTS codes instead; see AADSTS error codes 120000 and above.

References#

• Troubleshoot self-service password reset in Microsoft Entra ID (Microsoft Learn): SSPR_00xx codes and usage errors.
• Troubleshoot self-service password reset writeback (Microsoft Learn): event log codes and common writeback errors.
• Enable cloud sync self-service password reset writeback (Microsoft Learn): Cloud Sync prerequisites, permissions and unsupported operations.