Forum Discussion
CloudPasswordPolicyForPasswordSyncedUsersEnabled
If a synchronized user account (for example, email address removed for privacy reasons) is configured with "Password Never Expires" in on-premises Active Directory, and CloudPasswordPolicyForPasswordSyncedUsersEnabled is enabled, will Microsoft 365 continue to honor the on-premises setting, or will the user become subject to the Microsoft Entra password expiration policy?
Specifically, we are seeking confirmation on the following:
1. Does the on-premises Password Never Expires setting automatically carry over to Microsoft 365 after enabling CloudPasswordPolicyForPasswordSyncedUsersEnabled?
2. Or must DisablePasswordExpiration be explicitly configured in Microsoft 365 for such users to remain exempt from password expiration?
1 Reply
For password-hash-synchronized users, do not rely on the on-premises “Password Never Expires” flag as a cloud exemption after enabling CloudPasswordPolicyForPasswordSyncedUsersEnabled. Microsoft documents the cloud exception separately through the user’s PasswordPolicies attribute.
Enabling the feature does not immediately remove existing DisablePasswordExpiration values. Microsoft says removal occurs at the next password hash synchronization following that user’s on-premises password change; newly synchronized users do not receive the default exemption. Consequently, an account may initially appear exempt without its on-premises flag being the reason.
Inspect the user’s cloud PasswordPolicies value and the expiration policy for its verified domain. If a cloud exemption is required, explicitly configure DisablePasswordExpiration for that account using Microsoft Graph, with approved permissions.
Verify again after relevant synchronization events. Microsoft also documents that a full password hash synchronization associated with Entra Domain Services can clear these values, requiring exemptions to be reapplied. Test with a noncritical account before changing production-wide settings.
