Help Desk to initiate a password reset for an user instead of self service?

To disable or limit self-service password resets (SSPR) for end users while allowing administrators to initiate password reset requests, you can configure the SSPR settings in Microsoft Entra ID. Here are the steps you can follow:

1. Disable Self-Service Password Reset: You can disable SSPR for all users or specific groups by adjusting the settings in the Microsoft Entra admin center. This will prevent users from initiating password resets on their own.
2. Enable Help Desk Password Reset: You can set up a process where designated help desk personnel can reset passwords for users. This can be done through the admin portal where administrators can directly reset user passwords without needing the user to initiate the process.
3. Use Email or Controlled Mechanism: If you want to allow help desk staff to initiate password resets via email or another controlled mechanism, you may need to implement a custom workflow or use existing IT service management tools that integrate with Microsoft Entra ID to manage these requests securely.
4. Monitor and Audit: Ensure that you have monitoring and auditing in place to track password reset requests initiated by help desk staff to maintain security and compliance.

For detailed guidance on how to configure these settings, refer to the Microsoft Entra documentation on self-service password reset and account management.

References:

• Microsoft Entra self-service password reset
• Enable users to unlock their account or reset passwords using Microsoft Entra self-service password reset

I personally would not recommend this. Its easy to socially engineer someone on the help desk to reset a password.

Instead allow SSPR, require 2 MFA methods and use TAP to allow users to bootstrap themselves

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass

Down the road, look to https://blog.admindroid.com/self-service-account-recovery-with-identity-verification-in-entra-id/

Yes, you should be able to toggle the forceChangePasswordNextSignIn flag (or even better, the forceChangePasswordNextSignInWithMfa one) on the user, which should then result in them being prompted to change their password on login. As for preventing self-service password resets, this is controlled via the Password reset page/settings in the Entra portal.