Forum Discussion

Steel Contributor

Feb 01, 2019

Password Expiration with AAD connect Password hash sync

When Password Sync is enabled, the cloud password for a synchronized user is set to “never expires”. This means that the password synchronized to the cloud is still valid after the on-premises pass...

office 365

lucafabbri365

Brass Contributor

Aug 27, 2019

Hello Marvin Oco,

I noticed MS is working to find the better solution about this (link: https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/18367720-allow-password-expiration-policy-to-sync-from-on-p).

At meanwhile, even if PasswordNeverExpires=True when password sync is enabled (AADConnect), however, Azure let change the attribute to False via PowerShell, can it be considered a workaround? Will it inherit the password expiration policy set in Azure AD, then ?

What about ?

Thank you,

Luca

TimLB

Steel Contributor

May 29, 2020

I was investigating into this situation a bit and upon finding this thread - I thought it might be good to update it. Microsoft has added a feature in public preview where you can turn on password expiration when using the password hash synchronization scenario. Bad news however. documentation recommends that this be turned on before password sync is turned on.

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization#public-preview-of-the-enforcecloudpasswordpolicyforpasswordsyncedusers-feature

Also, I've seen comments in the user voice post Luca referenced saying that people have contacted MS support and have received other ways to work around this.