We did get around this. We are now using the build in user 'communities-user-admin' instead of our own service account. We do like to understand why our own account did not work. Most likely because we did not add our own service account to the 'user-administrators' group role which has probably a setting to allow changes to users&groups. Note: we still cannot add node/change node for the the build in 'admin' account. Most likely this is a protected account and only 'admin' user can change 'admi...

@Mayank_Gandhi We already use the externalizer on the outgoing message, but the issue here is the validation when the user submit the result from the page after entering a new password. The customer face URL is a nice formatted URL, while the actual internal server URL inside the safe zone is a very different URL. The system will generate the ky value with the Externalizer generated URL while it validate the URL with the internal host name. This will never match in this case.