diff --git a/redfish-core/include/error_messages.hpp b/redfish-core/include/error_messages.hpp
index 4d71745..6e280c0 100644
--- a/redfish-core/include/error_messages.hpp
+++ b/redfish-core/include/error_messages.hpp
@@ -764,6 +764,17 @@
 void queryParameterOutOfRange(crow::Response& res, const std::string& arg1,
                               const std::string& arg2, const std::string& arg3);
 
+/**
+ * @brief Formats PasswordChangeRequired message into JSON
+ * Message body: The password provided for this account must be changed
+ * before access is granted.  PATCH the 'Password' property for this
+ * account located at the target URI '%1' to complete this process.
+ *
+ * @param[in] arg1 Parameter of message that will replace %1 in its body.
+ *
+ * @returns Message PasswordChangeRequired formatted to JSON */
+void passwordChangeRequired(crow::Response& res, const std::string& arg1);
+
 } // namespace messages
 
 } // namespace redfish
diff --git a/redfish-core/include/node.hpp b/redfish-core/include/node.hpp
index 9086f1e..a6e1e27 100644
--- a/redfish-core/include/node.hpp
+++ b/redfish-core/include/node.hpp
@@ -169,8 +169,8 @@
         res.end();
     }
 
-    /* @brief Would the operation be allowed if the user did not have
-     * the ConfigureSelf Privilege?
+    /* @brief Would the operation be allowed if the user did not have the
+     * ConfigureSelf Privilege?  Also honors session.isConfigureSelfOnly.
      *
      * @param req      the request
      *
@@ -181,9 +181,18 @@
         const std::string& userRole = req.userRole;
         BMCWEB_LOG_DEBUG << "isAllowedWithoutConfigureSelf for the role "
                          << req.userRole;
-        Privileges effectiveUserPrivileges =
-            redfish::getUserPrivileges(userRole);
-        effectiveUserPrivileges.resetSinglePrivilege("ConfigureSelf");
+        Privileges effectiveUserPrivileges;
+        if (req.session && req.session->isConfigureSelfOnly)
+        {
+            // The session has no privileges because it is limited to
+            // configureSelfOnly and we are disregarding that privilege.
+            // Note that some operations do not require any privilege.
+        }
+        else
+        {
+            effectiveUserPrivileges = redfish::getUserPrivileges(userRole);
+            effectiveUserPrivileges.resetSinglePrivilege("ConfigureSelf");
+        }
         const auto& requiredPrivilegesIt = entityPrivileges.find(req.method());
         return (requiredPrivilegesIt != entityPrivileges.end()) &&
                isOperationAllowedWithPrivileges(requiredPrivilegesIt->second,
diff --git a/redfish-core/include/privileges.hpp b/redfish-core/include/privileges.hpp
index 1ca57fa..35f619b 100644
--- a/redfish-core/include/privileges.hpp
+++ b/redfish-core/include/privileges.hpp
@@ -196,7 +196,23 @@
         return (privilegeBitset & p.privilegeBitset) == p.privilegeBitset;
     }
 
+    /**
+     * @brief Returns the intersection of two Privilege sets.
+     *
+     * @param[in] privilege  Privilege set to intersect with.
+     *
+     * @return               The new Privilege set.
+     *
+     */
+    Privileges intersection(const Privileges& p) const
+    {
+        return Privileges{privilegeBitset & p.privilegeBitset};
+    }
+
   private:
+    Privileges(const std::bitset<maxPrivilegeCount>& p) : privilegeBitset{p}
+    {
+    }
     std::bitset<maxPrivilegeCount> privilegeBitset = 0;
 };