[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > [Step-by-step guides](index.md) > Authentication > Configuring self-service password reset (SSPR)

# Configuring self-service password reset in Yandex Identity Hub

You can enable [self-service password reset (SSPR)](https://en.wikipedia.org/wiki/Self-service_password_reset) for [local](../../iam/concepts/users/accounts.md#local) Yandex Identity Hub users using [MFA policies](../concepts/mfa.md).

To configure self-service password reset:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shield](../../_assets/console-icons/shield.svg) **Security settings**.
  1. Navigate to the **MFA policies** tab.
  1. In the MFA policy list, click ![ellipsis](../../_assets/console-icons/ellipsis.svg) in the policy row and select ![pencil](../../_assets/console-icons/pencil.svg) **Edit**. If you do not have an MFA policy, [create](mfa/create-policy.md) a new one. In the window that opens:

      1. To enable [self-service password reset](../concepts/sspr.md) for users added to an MFA policy target group, under **Self-reset password**:

          1. Enable **Allow password reset**.
          1. In the **Reset method** field, select at least one user verification method during the password reset:

          * `Sequential entry of any two authenticators`: Reset method where the user confirms their identity using any two verification methods, e.g., a TOTP and an SMS code.
          
              To use this method, the user account must have at least two [MFA factors](../concepts/mfa.md#mfa-factors) configured. Otherwise, only a [user pool](../concepts/user-pools.md) administrator can reset the password.
          * `FIDO2 with mandatory user verification`: Reset method where the user can verify their identity using a [FIDO2](https://en.wikipedia.org/wiki/FIDO_Alliance#FIDO2) key or [Passkey](https://www.passkeys.com/), but only together with local verification, such as a PIN, biometrics, etc.
          
              To use this password reset method, the user account must have a [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) MFA factor configured. Otherwise, only a user pool administrator can reset the password.

      {% note info %}

      To disable self-service password reset, disable **Allow password reset** under **Self-reset password**.

      {% endnote %}

  1. Click **Save**.

{% endlist %}

#### Useful links {#see-also}

* [Self-service password reset in Yandex Identity Hub](../concepts/sspr.md)
* [Multi-factor authentication in Yandex Identity Hub](../concepts/mfa.md)
* [Resetting your password for the Yandex Cloud management console](user-account/reset-password.md)