Why SuperSupport Does Not Reset Passwords

An AI agent that resets passwords is an attack path with a chat window.

“Password reset in seconds, fully automatic with AI.” Many AI service desks advertise with this promise. Technically it is simple: you connect the bot to Active Directory or Microsoft Entra ID, give it write permissions, and it resets passwords and MFA methods when an employee asks for it in the chat.

SuperSupport deliberately does not do this. Here is why, and what happens instead.

What SuperSupport is, and what it is not

SuperSupport is first-level support on the device. The agent runs on the employee's Windows or Mac computer, checks what is going on there (printer, Outlook, OneDrive, network, updates, storage), fixes harmless things itself and submits anything sensitive to IT for approval.

SuperSupport is not identity management. There is no write connection to Active Directory or Entra ID. Creating accounts, resetting passwords, changing MFA methods, assigning groups: that stays with IT and with the tools built for it.

Reason 1: MFA reset is attackers' favorite target

A stolen password list is of little use to attackers as long as MFA is active. That is why they try to defeat the second factor, and the most convenient route is the help desk. Several well-known attacks on large companies began with a phone call: someone posed as an employee and asked for multifactor authentication to be reset.

A chatbot that resets MFA on request makes this attack even easier: no person who might get suspicious, no check back with a manager, available around the clock. See also Unexpected MFA request and Fake Microsoft support.

Reason 2: Fewer permissions, less attack surface

Every system with write access to central user management is a key to the whole company. Whoever compromises it can change passwords, take over accounts and give themselves permissions.

The principle of least privilege also applies to support tools: SuperSupport does not need write access to Entra ID to fix a printer or get Outlook working again, so it does not get it. That fits what insurers and auditors ask about, see Cyber insurance and NIS2.

Reason 3: Identity verification does not belong in a chat

Before a reset, it has to be certain that the employee is really the one asking. A chat window on a computer does not prove that: the computer can be stolen, unlocked or used by someone else. Identity verification is done by Microsoft in self-service password reset with registered methods, or by IT through a callback to a known number, in person or with a time-limited temporary access pass.

Reason 4: Microsoft already solves it, and better

Self-service password reset (SSPR) in Entra ID is built for exactly this. Employees verify themselves with Authenticator, phone or passkey and reset their password on their own, in two minutes, with Microsoft's security checks and logging. An additional AI interface that does the same with more permissions adds no value, only more risk. See Forgot your password? Self-service reset.

What SuperSupport does instead

Beta

IT support that fixes itself.

supersupport.ai handles your 1st-level support fully automatically. Secure your spot on the waitlist now.

Join the Waitlist

“I can't get in anymore” is still a first-level case, just solved differently:

• Forgotten password – guides through self-service reset
• Account locked by old credentials – finds and removes old passwords saved on the device that trigger the lockout
• Office/Outlook keeps asking for sign-in – checks connected accounts, time, Credential Manager; see Office sign-in
• New phone, Authenticator gone – guides through the switch as long as the old device is still there; see Authenticator on a new phone
• Only an admin can help – hands the case to IT with all details, without changing anything about the identity itself

The result: most “I can't get in” cases are solved before anyone has to call, and the sensitive ones land with IT fully described instead of being waved through automatically.

Who is this the right choice for?

• Small and midsize businesses that do not want another system with admin rights on their user management.
• MSPs that look after many tenants and do not want to give a bot write permissions in every customer tenant.
• Companies with audit and insurance requirements that have to demonstrate clear roles and few privileged accesses.

If, on the other hand, you want to have every request, including account management, handled fully automatically and build your own identity verification in front of it, a classic AI service desk may serve you better. See rezolve.ai alternative and Moveworks alternative.

What does SuperSupport offer?

SuperSupport takes over first-level IT support via chat, directly on the Windows or Mac device: the agent handles harmless things itself, submits sensitive ones to IT for approval, every step is logged, and every chat is also the case record. How this looks for internal IT teams and MSPs is described on the respective pages.

Frequently asked questions

Can SuperSupport reset passwords or MFA?

No, deliberately not. SuperSupport has no write connection to Active Directory or Microsoft Entra ID. Password and MFA resets go through Microsoft's self-service password reset or through IT, with identity verification.

Why is an automatic MFA reset by AI risky?

Because an MFA reset is exactly what attackers want. Well-known attacks on companies began with someone posing as an employee to the help desk and having multifactor authentication reset. A chatbot that does this automatically is an especially convenient target for such deception.

What does SuperSupport do instead when someone cannot get in anymore?

The agent clarifies whether the password was forgotten or expired or the account is locked, removes old saved credentials on the device that trigger lockouts, guides through Microsoft 365 self-service reset, and hands everything that only an administrator can solve to IT with complete details.

Isn't that a disadvantage compared to other AI service desks?

For companies that want to automate every request, maybe. For small and midsize businesses and MSPs it is usually an advantage: fewer permissions for another system, no write access to central user management, a clear separation between support on the device and management of identities.

What about self-service password reset?

It is the right way. Microsoft offers it in Entra ID: employees verify themselves with registered methods and reset their password on their own. That is faster than any chat and uses Microsoft's security checks instead of an additional interface.

Beta

IT support that fixes itself.

supersupport.ai handles your 1st-level support fully automatically. Secure your spot on the waitlist now.

Join the Waitlist