[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > Concepts > Self-service password reset (SSPR)

# Self-service password reset in Yandex Identity Hub

You can enable [self-service password reset (SSPR)](https://en.wikipedia.org/wiki/Self-service_password_reset) for [local](../../iam/concepts/users/accounts.md#local) Yandex Identity Hub users. This feature comes in handy when users forget or lose their passwords.

Users can [reset their password](../operations/user-account/reset-password.md) on their own on the Yandex Cloud login page. At the same time, the user must verify their identity using the verification methods set by the [MFA policy](mfa.md#mfa-policies).

The option for users to reset their own passwords and the available _reset methods_ are configured in the MFA policy settings. Currently, you can only [configure](../operations/manage-sspr.md) this option in the [Cloud Center UI](https://center.yandex.cloud/organization). To manage MFA policies, you need the `organization-manager.editor` [role](../security/index.md#organization-manager-editor) or higher.

## Password reset methods {#reset-methods}

To enable self-service password reset for users in the MFA policy settings, you must set at least one password reset method:

* `Sequential entry of any two authenticators`: Reset method where the user confirms their identity using any two verification methods, e.g., a TOTP and an SMS code.

    To use this method, the user account must have at least two [MFA factors](mfa.md#mfa-factors) configured. Otherwise, only a [user pool](user-pools.md) administrator can reset the password.
* `FIDO2 with mandatory user verification`: Reset method where the user can verify their identity using a [FIDO2](https://en.wikipedia.org/wiki/FIDO_Alliance#FIDO2) key or [Passkey](https://www.passkeys.com/), but only together with local verification, such as a PIN, biometrics, etc.

    To use this password reset method, the user account must have a [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) MFA factor configured. Otherwise, only a user pool administrator can reset the password.

You can also enable multiple password reset methods simultaneously in the MFA policy's self-service password reset settings.

#### Useful links {#see-also}

* [Multi-factor authentication in Yandex Identity Hub](mfa.md)
* [Configuring self-service password reset in Yandex Identity Hub](../operations/manage-sspr.md)
* [Resetting your password for the Yandex Cloud management console](../operations/user-account/reset-password.md)