Password reset
A password reset replaces an account's password through a recovery or administrative process, typically without requiring the current password.
When the old password is unavailable
A reset replaces a forgotten or compromised password after a recovery or administrative check. A routine password change usually requires the current password or an authenticated session; the exact requirements depend on the service.
For a self-service reset link, OWASP recommends a securely generated token that expires and works only once. It also recommends notifying the account holder after the password changes. The reset link deserves protection because whoever can use it may be able to choose the next password.
A successful reset means the service accepted the request. It does not establish that the employee, rather than an attacker who gained access to the recovery channel, made it.
A reset is not a complete eviction
Changing a password is different from replacing an MFA method or revoking sessions. Microsoft notes that Entra cannot directly revoke session tokens issued by applications themselves.
During containment, check those application sessions separately. Avoid closing the incident simply because the old password no longer works.