CanResetCredential
Source can reset/replace target's password/MFA and take over.
Identity
── CanResetCredential ──▸
Identity, HumanIdentity
Source types
IdentityTarget types
IdentityHumanIdentityStates
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws |
iam:UpdateLoginProfile
|
|
| gcp | - | Workspace admin password reset. |
| azure |
Authentication Administrator / reset password (Graph)
|
Rules that emit CanResetCredential 11
awsderived
User Administrator role in B2C tenant can reset B2C consumer account passwords, enabling account takeover.
azurederived
azurederived
A service principal holding User.ReadWrite.All (or Directory.ReadWrite.All) can reset any non-protected Entra user's password via PATCH /users/{id} with a new passwordProfile, taking over that user's account and inheriting their RBAC and group memberships.
azurederived
Workspace delegated admin (or super-admin) with the USER_MANAGEMENT / password-reset privilege can reset any non-admin user's password, hijacking their account.
gcpderived
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
cloudsql.users.update on a Cloud SQL instance lets a principal reset any DB user's password, including root/admin DB users.
gcpexplicit