Password Expiration with AAD connect Password hash sync

lucafabbri365
Brass Contributor
May 29, 2020
Hello TimLB,
well, we implemented the EnforceCloudPasswordPolicyForPasswordSyncedUsers feature time ago, and set the same password expiration policy like on-premise AD (90 days*) but unfortunately, it was enabled with password hash sync already in place; so every time a new user is synced to Azure AD (initial sync of password) the PasswordPolicies attribute is set to DisablePasswordExpiration value by default. The (manual) solution is to change it via PowerShell:

Single user:

Set-AzureADUser -ObjectId <user ID> -PasswordPolicies None

In bulk:

Get-AzureADUser -All $true | Set-AzureADUser -PasswordPolicies None

I hope Microsoft can find a more flexible way to manage it.

* - There is a limit when there are multiple on-premise AD domains with different password expiration policy, all syncing with same Azure AD tenant through AAD Connect and sharing the same registered domain.
- ANAND_SUNKA
  Brass Contributor
  Feb 02, 2021
  Hilucafabbri365,
  
  We have similar issue and it's a major security concern. Now my infosec team wants to get rid of expired passwords should get block.
  
  As i said am planning to run below command for entire Organization.
  Get-AzureADUser -All $true | Set-AzureADUser -PasswordPolicies None
  Is it going to impact the users which are already logged into the mailboxes, cloud apps, on-prem custom apps when we run the above command.
  
  Any help really appreciated.
- ThomasK007
  Copper Contributor
  Jun 16, 2020
  Just to be sure:
  
  When the on-premise password expiration policy is set to 90 days and the Azure AD policy is also set to 90 days, the password expires at the same time for on-premise and in the cloud, regardless when the Azure AD policy pwd is set to on?
  
  Thanks
  - lucafabbri365
    Brass Contributor
    Jun 17, 2020
    ThomasK007,
    I try to give you a detailed answer.
    Until you have the EnforceCloudPasswordPolicyForPasswordSyncedUsers disabled (which is the default), an Azure AD user coming from on-premise AD (synced by AAD Connect) has its account password set to Never Expire.
    
    "Password expiration policy
    If a user is in the scope of password hash synchronization, by default the cloud account password is set to Never Expire.
    You can continue to sign in to your cloud services by using a synchronized password that is expired in your on-premises environment. Your cloud password is updated the next time you change the password in the on-premises environment."
    
    Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization#public-preview-of-the-enforcecloudpasswordpolicyforpasswordsyncedusers-feature | Microsoft Docs
    
    Once you enable the EnforceCloudPasswordPolicyForPasswordSyncedUsers feature and set the PasswordPolicies attribute to None (instead of DisablePasswordExpiration), the expiration time for an Azure AD user should be calculated referring to read-only attribute LastPasswordChangeTimestamp (you can retrieve it by using the Get-MsolUser cmdlet), depending on expiration policy.
    
    Now if you have AAD Connect with password hash sync, same password expiration policy set on both Azure AD and on-premise AD (e.g. 90 days), every time a password is changed on-premise AD, pwdlastset attribute is updated, the password itself synced with Azure AD and the LastPasswordChangeTimestamp updates accordingly - so they both expires at same time (maybe few minutes off); if you also have the password writeback functionality in place (link: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback | Microsoft Docs) the behavior described above works when the password is change from Azure AD and synced back to on-premise AD.
    
    It should be right (please, can someone else confirm that ?)
    I hope I was clear.
    
    Bye,
    Luca

Forum Discussion

Password Expiration with AAD connect Password hash sync

Resources