Forum Discussion

Jente Paredis's avatar
Jente Paredis
Copper Contributor
Aug 08, 2017

unexpected behavior with set-msoluserpassword pertaining to synced identities

All, While testing new Office 365 features for a customer of  mine, I came across the following situation, which kind of puzzles me.   My test tenant has synchronized users from my Domain Controll...
Azure Active Directory (AAD)
VasilMichev's avatar
VasilMichev
MVP
Aug 08, 2017

That's actually the expected behavior.

 

An administrator can manually reset your password by using Windows PowerShell.

In this case, the new password overrides your synchronized password, and all password policies defined in the cloud are applied to the new password.

If you change your on-premises password again, the new password is synchronized to the cloud, and it overrides the manually updated password.

The synchronization of a password has no impact on the Azure user who is signed in. Your current cloud service session is not immediately affected by a synchronized password change that occurs while you're signed in to a cloud service. KMSI extends the duration of this difference. When the cloud service requires you to authenticate again, you need to provide your new password.

 

From the documetnation here: https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization.md#overwrite-synchronized-passwords

Resources