When using ExCM you can disable the default security question-based reset user password dialog and instead turn on the email-based reset password option. This document walks through the process using the new automated feature that has been introduced in ExCM 2016 version or later and ExCM 2019 version or later.
The new automation options are on the Password Policy page in General Application Settings:
Once the Password Policy page is loaded, select the extranet web application and the extranet membership provider that these changes are to be made to:
Once a membership provider is selected, the radio buttons in the new Self-service Password Reset Option section will be usable. By default, the Q&A option will be selected, but selecting “Send system-generated new password via email” and clicking the OK button will make the same changes (within 5 - 10 minutes) to the web.config that were previously done manually.
Below you will find the expected changes that users will experience, once the password reset has been changed from the question and answer to the email setting. After the user clicks the “Forgot your password?” link the “Reset My Password” page will ask for the user’s email address, then they will need to click next.
Once the user enters an email address and clicks next, they will see the confirmation page that looks like this:
If the email entered is for a valid external user, that user will receive an email with a new system-generated temporary password:
If the email entered is invalid (ie. the email address entered is NOT for a valid external user), no email will be sent.
Once the external user has received the email with the new password, they can either click the Continue to Login button on the confirmation page, or navigate back to the sign in page as they normally would. Then they would enter their user name and new temporary password to log in.
Upon successful login with the temporary password, the user will be automatically redirected to the “Change My Password” page where they will need to use the temporary password and create their own new password before clicking Finish:
At this point, the user will be redirected away from the root site collection and on to the specific extranet site that they were initially trying to access.
Ensuring that external users have access to the Change My Password page:
When switching from security question-based password reset to email-based password reset, ExCM requires the external user to change from the temporary password on the first login with it. It does this by first redirecting to the root site collection of your extranet web application - for instance, https://extranet.mycompany.com/.
Because of this one-time redirection logic, it is necessary that all external users have Visitor permissions to your root site collection. If they do not have those permissions, they will receive an "Access Denied" message when the Change My Password page tries to load.
Here is how to give all external users Visitor permissions in your root site collection:
First, navigate to the root site collection in your extranet web application.
Then, logged in as a Site Collection Administrator:
Find the Visitors group in the list on the left and click on it:
Once there, add a New User to the group:
Add the "All Users (Ext)" role to the group:
Now, all of your external users will have access to the Change My Password page when it is loaded from the root site collection.