diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/forgetpassword/PageResetPassword.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/forgetpassword/PageResetPassword.java
index 290ba9ebe31..9c42d7c178c 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/forgetpassword/PageResetPassword.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/forgetpassword/PageResetPassword.java
@@ -8,6 +8,7 @@
 
 import com.evolveum.midpoint.web.application.Url;
 import com.evolveum.midpoint.web.page.admin.home.dto.MyPasswordsDto;
+import com.evolveum.midpoint.web.page.admin.home.dto.PasswordAccountDto;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType;
 
 import org.apache.wicket.ajax.AjaxRequestTarget;
@@ -28,6 +29,9 @@
 import com.evolveum.midpoint.web.page.self.PageSelf;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
 
+import java.util.Collections;
+import java.util.List;
+
 @PageDescriptor(
         urls = {
                 @Url(mountUrl = PageResetPassword.URL, matchUrlForSecurity = PageResetPassword.URL)
@@ -108,4 +112,20 @@ protected void createBreadcrumb() {
     protected boolean shouldLoadAccounts(MyPasswordsDto dto) {
         return false;
     }
+
+    @Override
+    protected List<PasswordAccountDto> getSelectedAccountsList() {
+        List<PasswordAccountDto> accounts = getModelObject().getAccounts();
+        if (accounts.isEmpty()) {
+            return Collections.EMPTY_LIST;
+        }
+
+       for (PasswordAccountDto account : accounts) {
+           if (account.isMidpoint()) {
+               return Collections.singletonList(account);
+           }
+       }
+
+       return accounts;
+    }
 }
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageAbstractSelfCredentials.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageAbstractSelfCredentials.java
index bc08468e480..3c3ce4be1b3 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageAbstractSelfCredentials.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/PageAbstractSelfCredentials.java
@@ -201,7 +201,12 @@ private void initLayout() {
 
             @Override
             public WebMarkupContainer getPanel(String panelId) {
-                return new ChangePasswordPanel(panelId, isCheckOldPassword(), model, model.getObject());
+                return new ChangePasswordPanel(panelId, isCheckOldPassword(), model, model.getObject()) {
+                    @Override
+                    protected boolean shouldShowPasswordPropagation() {
+                        return shouldLoadAccounts(getModelObject());
+                    }
+                };
             }
         });
 
@@ -275,8 +280,6 @@ private PasswordAccountDto createPasswordAccountDto(PrismObject<ShadowType> acco
     }
 
     protected void onSavePerformed(AjaxRequestTarget target) {
-        List<PasswordAccountDto> selectedAccounts = getSelectedAccountsList();
-
         ProtectedStringType oldPassword = null;
         if (isCheckOldPassword()) {
             LOGGER.debug("Check old password");
@@ -310,13 +313,16 @@ protected void onSavePerformed(AjaxRequestTarget target) {
                 }
             }
         }
-        if (selectedAccounts.isEmpty()) {
-            warn(getString("PageSelfCredentials.noAccountSelected"));
+
+        if (getModelObject().getPassword() == null ) {
+            warn(getString("PageSelfCredentials.emptyPasswordFiled"));
             target.add(getFeedbackPanel());
             return;
         }
-        if (getModelObject().getPassword() == null ) {
-            warn(getString("PageSelfCredentials.emptyPasswordFiled"));
+
+        List<PasswordAccountDto> selectedAccounts = getSelectedAccountsList();
+        if (selectedAccounts.isEmpty()) {
+            warn(getString("PageSelfCredentials.noAccountSelected"));
             target.add(getFeedbackPanel());
             return;
         }
@@ -333,7 +339,6 @@ protected void onSavePerformed(AjaxRequestTarget target) {
             SchemaRegistry registry = getPrismContext().getSchemaRegistry();
             Collection<ObjectDelta<? extends ObjectType>> deltas = new ArrayList<>();
 
-
             for (PasswordAccountDto accDto : selectedAccounts) {
                     PrismObjectDefinition objDef = accDto.isMidpoint() ?
                             registry.findObjectDefinitionByCompileTimeClass(UserType.class) :
@@ -376,7 +381,7 @@ protected void setNullEncryptedPasswordData() {
 
     protected abstract void finishChangePassword(OperationResult result, AjaxRequestTarget target);
 
-    private List<PasswordAccountDto> getSelectedAccountsList(){
+    protected List<PasswordAccountDto> getSelectedAccountsList(){
         List<PasswordAccountDto> passwordAccountDtos = model.getObject().getAccounts();
         List<PasswordAccountDto> selectedAccountList = new ArrayList<>();
         if (model.getObject().getPropagation() != null
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/component/ChangePasswordPanel.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/component/ChangePasswordPanel.java
index 23323d42848..d9529ad0ac0 100644
--- a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/component/ChangePasswordPanel.java
+++ b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/page/self/component/ChangePasswordPanel.java
@@ -146,10 +146,20 @@ public void onClick(AjaxRequestTarget target) {
         };
 
         accountContainer.add(help);
+        accountContainer.add(new VisibleEnableBehaviour() {
+            @Override
+            public boolean isVisible() {
+                return shouldShowPasswordPropagation();
+            }
+        });
 
         add(accountContainer);
     }
 
+    protected boolean shouldShowPasswordPropagation() {
+        return true;
+    }
+
     private List<IColumn<PasswordAccountDto, String>> initColumns() {
         List<IColumn<PasswordAccountDto, String>> columns = new ArrayList<>();