Credential Governance
Change Password
People change their own password once, and it is synchronized to the other systems they pick.
Completes when your sign-in directory account takes the new password; it is then synchronized to the other systems you picked, and the results page shows each one.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Change Password from the AI Assistant You Already Use
In Avabot and MCP, "change my password" runs a reset instead: you verify in the conversation, and a generated password is emailed or texted to you. One completed change (or, in chat, reset) = one Secure Outcome; failed attempts are never billed.
You: Change my password. Avatier: verify: passed · runs as: a reset · new password: generated, sent by text · current password: not needed
Why it matters
One Password Change Should Reach Every System.
When each system's password is changed on its own, they drift apart, and people lose track of which one they changed.
What a change needs
The current password, then a new one that passes your policy, set on the sign-in account first and synchronized to the other systems the person picks.
What goes wrong by hand
Changing each system's password separately leaves them out of step, and a password that expires on one system turns into a help desk call.
What Change Password does
The sign-in directory account is changed first, with the current password; if that fails, nothing else changes. The new password then goes to the other selected systems.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone changes a password this month or not. Pay Per Identity Action™ charges only for completed password changes.
The Action
How Change Password Runs
On the web, Change Password walks through these screens. In Avabot and MCP, "change my password" runs a password reset that sends you a generated password.
Open Change Password
Sign in and open the Change Password tile. When a Strong MFA sign-in reports that your password must be updated, you are taken to a restricted Change Password screen first.
Verify, If Your Tenant Requires It
Off by default. When your tenant turns it on, you answer the challenge its Password Management workflow sets, with the methods your policy already allows.
Pick the Systems
Your sign-in directory account is included and, by default, cannot be deselected. Tick the other systems to update.
Set the New Password
Type your current password, then the new password and its confirmation. When Password Bouncer is on, a live checklist shows the policy rules, and a generator appears when your tenant enables it.
See the Results
The sign-in account is changed first, then the new password is synchronized to the other selected systems, and the results page shows each system's outcome. A wrong current password stops the whole change. There is no approval and no justification.
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, "change my password" runs a password reset instead: after verification in chat, Avabot sets a generated password and emails or texts it to you, and no current password is asked for.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. Completes when your sign-in directory account takes the new password; it is then synchronized to the other systems you picked, and the results page shows each one. If that first change fails, nothing else is changed. It creates no request. One completed password change = one Secure Outcome.
Evidence
- An activity-log entry for each system, recorded as a password change (also sent to syslog or your SIEM)
- The Password Changes audit report
- The results page, with each system's outcome
- A results email, when your tenant's template is on
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Pay Per Identity Action™
Pay per Completed Password Change
Pay per completed password change. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Change Password, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed password changes only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | The sign-in account is changed first, then the new password is synchronized to every system picked |
| Evidence | Silent failures and missing audit trails | An activity-log entry for each system and the Password Changes audit report |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems a Password Change Touches
Change Password sets the new password in Active Directory, Entra ID, LDAP directories and connected apps whose connector can set passwords, checked against Password Bouncer policy when Password Bouncer is enabled.
- LDAP
- Microsoft
- Active Directory and Entra ID accounts, through their connectors.
- Connected Apps
- Apps whose connector can set passwords.
- Password Bouncer
- When enabled, the new password is checked against its policy.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Why can't I deselect my main directory account?
Change Password always changes your sign-in account first and then synchronizes the others. An admin can allow it to be deselected.
Do I need my current password?
Yes, on the web. If you don't know it, use Forgot Password.
Can Avabot change my password?
It runs a reset instead. After verification, it sets a generated password and emails or texts it to you.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Change Password
You've Automated the System. Now Secure the Credentials.
People change their password once, on the systems they pick, with each change in the activity log.