The Hidden Cost of Password Reset Tickets to Your IT Team

A password reset takes 30 seconds of actual work. The ticket around it — the user filing it, the IT engineer picking it up, the back-and-forth to verify identity, the temp password handoff, the inevitable "I forgot the new one" follow-up — costs significantly more.

Industry studies put the fully-loaded cost of an IT-handled password reset at $25-70 per ticket depending on the org's size, IT seniority mix, and whether the user is locked out of revenue-generating work during the wait. For most SMBs the cost is at the lower end of that range; for organizations where the locked-out user is a sales person mid-pitch or a clinician between patients, the cost runs higher.

Multiply by ticket volume and the annual line item is startling. Here's the math, and what it actually costs to remove this line item from your budget.

The cost breakdown

A typical password reset ticket has four cost components:

1. IT engineer time (15-30 minutes per ticket, fully loaded)

The actual reset takes 30 seconds. The ticket workflow does not:

• Read the ticket (~30 seconds)
• Verify the requester's identity (~2-5 minutes — phone call, secondary email check, or a quick walk-over for in-office staff)
• Open the admin center, find the user, click reset, generate the temp password (~1 minute)
• Communicate the temp password securely (~2 minutes — secure messaging, hand-off in person, or — wrongly but commonly — emailing it)
• Close the ticket with notes (~1 minute)
• Field the inevitable follow-up when the user types it wrong twice and locks the account again (~5 minutes)

Add task-switching cost: the IT engineer was probably doing something else, and the context switch into and out of the ticket eats another 5-10 minutes of focused-work time.

At a fully-loaded IT engineer cost of $50-80/hour (salary + benefits + overhead), 20 minutes of engineer time = $17-27 per ticket.

2. User productivity loss while locked out

The user can't log in. If they're a knowledge worker, they're probably sitting idle, sending Slack messages from their personal phone, or doing busywork. If they're customer-facing, they may be losing actual revenue (missed sales calls, delayed customer responses, postponed meetings).

Average lockout duration before resolution: 30 minutes to 4 hours depending on IT response time. At a fully-loaded employee cost of $40-100/hour, that's $20-400 in lost productivity per incident.

3. Help desk system overhead

Every ticket consumes a row in your ticketing system, which (if you're on a per-user-per-month plan) you're paying for. Marginal cost is small per ticket (~$0.10-$0.50), but at scale it adds up.

4. Security exposure

Temp passwords emailed in plaintext, sticky-noted on monitors, or yelled across the room are a non-trivial security risk. The expected-cost-per-incident is hard to quantify but real. The average cost of a credential-related breach for an SMB sits in the low-six-figures range per IBM's Cost of a Data Breach Report — and "weak password handling during reset" is a documented attack vector.

For conservative budgeting, exclude this component. The first three alone are enough to justify the math.

The annual line item

A typical org generates 1-2 password reset tickets per user per year based on Gartner and HDI helpdesk industry benchmarks. Higher for orgs with frequent password rotation policies (every 90 days = 4x the baseline). Lower for orgs with passwordless auth or long-lived passwords with strong MFA.

For a 100-person org generating 150 reset tickets per year (1.5/user, midrange):

• Engineer time: 150 tickets × $20/ticket = $3,000
• Productivity loss (average 1hr lockout × $50/hr): 150 × $50 = $7,500
• Total: ~$10,500/year

For a 300-person org with frequent rotation generating 600 tickets per year:

• Engineer time: 600 × $20 = $12,000
• Productivity loss (1hr × $50): 600 × $50 = $30,000
• Total: ~$42,000/year

For a 50-person org with infrequent resets generating 60 tickets per year:

• Engineer time: 60 × $20 = $1,200
• Productivity loss: 60 × $50 = $3,000
• Total: ~$4,200/year

These numbers assume an in-house IT team. For organizations with an MSP, the engineer time component is billed directly — most MSPs charge $50-150/hour, and password resets eat a measurable fraction of MSA hours. We covered the MSP-side angle in Why MSPs Should Stop Using Shared Admin Accounts.

The three options for reducing this cost

Option 1: Self-service password reset (SSPR)

Microsoft's built-in SSPR lets users reset their own passwords by answering security questions or using a verified phone/email. Bundled in M365 Business Premium and E3+ plans at no additional cost.

This solves a chunk of the problem — somewhere between 30-60% of tickets disappear because users can self-serve. But:

• Initial enrollment friction (users have to set up their verification methods, which most don't bother doing until they're locked out)
• The "locked out and can't access my recovery email" subset still ends up as tickets
• For employees who share devices or have password problems compounded with MFA problems, SSPR isn't enough

If you're not using SSPR, turn it on today. It's the cheapest intervention available. If you're already using it and still have meaningful ticket volume, you need more.

Option 2: Delegate password reset access to HR or office managers

The pattern: someone in the office (HR coordinator, office manager, receptionist at smaller orgs) gets the ability to reset passwords for non-admin users. They handle resets in 30 seconds — typically the user is standing at their desk asking — and IT never sees the ticket.

This is the highest-ROI single intervention for orgs where SSPR isn't enough. The mechanic is covered in detail in How to Give HR Password Reset Access Without Global Admin.

Cost: $59-99/month for a delegation portal like UserDesk for M365, depending on org size. For a 100-person org doing 150 resets/year, the math:

• Annual delegation portal cost: $708 (Starter plan)
• Eliminated ticket cost: ~$10,500
• Net savings: ~$9,800/year

The delegation portal cost is fixed; the savings scale linearly with org size. At 300 users it's ~$1,200 in tool cost (Pro plan) vs ~$42,000 in eliminated ticket cost.

Option 3: Passwordless authentication

Long-term: eliminate passwords as a primary auth factor. Microsoft Authenticator's passwordless mode, Windows Hello for Business, FIDO2 hardware keys. The reset problem mostly disappears because there's nothing to reset.

This is the architecturally-cleanest answer and where everyone is heading, but the transition project is non-trivial (6-18 months for an SMB, with hardware costs for keys and meaningful change-management effort). Worth starting now if you're not already; not a near-term answer for an org dealing with the cost today.

The honest recommendation

Stack the interventions:

1. Turn on SSPR if you haven't. Zero additional cost. Eliminates 30-50% of tickets.
2. Delegate the residual to HR or office staff via a delegation portal. Eliminates most of the remaining IT-handled tickets at a per-month cost that's a fraction of the ticket cost it removes.
3. Plan passwordless migration on a 12-18 month timeline. This is the long-term answer.

The delegation step is where most orgs leave money on the table. Microsoft's Password Administrator role almost works for this but ships with the M365 admin center as its interface, which most HR coordinators won't actually use. A focused delegation portal with templates, audit logs, and a clean UI is what closes the gap.

See the password reset workflow: interactive demo at /demo. Click through the HR-coordinator view of doing a reset. No signup, sample data, ~30 seconds.