Microsoft Password Reset - Pass parameter that contains redirect URI for after reset

Question

We use OAuth 2 with Microsoft Azure Active Directory for single sign on. When a user logs out, we pass them to the following URL, in which we can pass a post_logout_redirect_uri query param:

https://login.microsoftonline.com/<tenant-id>/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fexample.com%2F

When a user tries to log in to our site, if they are not authenticated, they get directed to the Microsoft login page, and we pass a redirect_uri parameter here as well (with some other irrelevant query parameters).

https://login.microsoftonline.com/<tenant-id>/oauth2/authorize?redirect_uri=https%3A%2F%2Fexample.com%2F

If the user clicks the forgot password link on the login page, they can use Microsoft's Self Service Password Reset to reset their password, and then they get a link to log in with their new password (seen below). Clicking that link will take them back to the login page, and after they log in, they are redirected back to our site.

However, we also send out a link for users to access the password reset page directly:

https://passwordreset.microsoftonline.com

When a user follows this link, and resets their password, the To sign in with your new password, click here. link is not displayed. Is there any way to pass in a query parameter in this URL, similar to the login and logout endpoints, to have that link show up and redirect to the value passed for that parameter?

I have tried using redirect_uri and post_reset_redirect_uri to no avail, and have not been able to find any documentation on this.

Answer 1

Looking into the flow for password reset and all the query string parameters that it uses, I was able to get the link for To sign in with your new password, click here. using query string parameter ru

New Link that you should try out

https://passwordreset.microsoftonline.com?ru={url encoded value for return url}

Example:

https://passwordreset.microsoftonline.com?ru=https%3A%2F%2Flogin.microsoftonline.com%2F<tenant-id>%2Foauth2%2Fauthorize%3Fredirect_uri%3Dhttps%253A%252F%252Fexample.com%252F%26client_id%3DmyclientGUID%26response_type%3Did_token%26state%3D123456%26nonce%3DGUID

NOTE: The URL encoded value that I used is basically the same URL and parameters that get used when I try to login to my site, i.e. take the URL from browser when you're presented with Microsoft Login page as part of regular login to site. (nothing to do with password reset). Then provided a new random GUID for nonce and another random value for state parameters.

Disclaimer: I did not find any offical documentation for this. It's more out of hit & trial and going through HTTP requests created with regular password reset flow.