Forum Discussion
Password Expiration with AAD connect Password hash sync
I was investigating into this situation a bit and upon finding this thread - I thought it might be good to update it. Microsoft has added a feature in public preview where you can turn on password expiration when using the password hash synchronization scenario. Bad news however. documentation recommends that this be turned on before password sync is turned on.
Also, I've seen comments in the user voice post Luca referenced saying that people have contacted MS support and have received other ways to work around this.
Hello TimLB,
well, we implemented the EnforceCloudPasswordPolicyForPasswordSyncedUsers feature time ago, and set the same password expiration policy like on-premise AD (90 days*) but unfortunately, it was enabled with password hash sync already in place; so every time a new user is synced to Azure AD (initial sync of password) the PasswordPolicies attribute is set to DisablePasswordExpiration value by default. The (manual) solution is to change it via PowerShell:
Single user:
Set-AzureADUser -ObjectId <user ID> -PasswordPolicies None
In bulk:
Get-AzureADUser -All $true | Set-AzureADUser -PasswordPolicies None
I hope Microsoft can find a more flexible way to manage it.
* - There is a limit when there are multiple on-premise AD domains with different password expiration policy, all syncing with same Azure AD tenant through AAD Connect and sharing the same registered domain.
We have similar issue and it's a major security concern. Now my infosec team wants to get rid of expired passwords should get block.
As i said am planning to run below command for entire Organization.
Get-AzureADUser -All $true | Set-AzureADUser -PasswordPolicies None
Is it going to impact the users which are already logged into the mailboxes, cloud apps, on-prem custom apps when we run the above command.
Any help really appreciated.
- Just to be sure:
When the on-premise password expiration policy is set to 90 days and the Azure AD policy is also set to 90 days, the password expires at the same time for on-premise and in the cloud, regardless when the Azure AD policy pwd is set to on?
ThanksI try to give you a detailed answer.
Until you have the EnforceCloudPasswordPolicyForPasswordSyncedUsers disabled (which is the default), an Azure AD user coming from on-premise AD (synced by AAD Connect) has its account password set to Never Expire.
"Password expiration policy
If a user is in the scope of password hash synchronization, by default the cloud account password is set to Never Expire.
You can continue to sign in to your cloud services by using a synchronized password that is expired in your on-premises environment. Your cloud password is updated the next time you change the password in the on-premises environment."
Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization#public-preview-of-the-enforcecloudpasswordpolicyforpasswordsyncedusers-feature | Microsoft Docs
Once you enable the EnforceCloudPasswordPolicyForPasswordSyncedUsers feature and set the PasswordPolicies attribute to None (instead of DisablePasswordExpiration), the expiration time for an Azure AD user should be calculated referring to read-only attribute LastPasswordChangeTimestamp (you can retrieve it by using the Get-MsolUser cmdlet), depending on expiration policy.
Now if you have AAD Connect with password hash sync, same password expiration policy set on both Azure AD and on-premise AD (e.g. 90 days), every time a password is changed on-premise AD, pwdlastset attribute is updated, the password itself synced with Azure AD and the LastPasswordChangeTimestamp updates accordingly - so they both expires at same time (maybe few minutes off); if you also have the password writeback functionality in place (link: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback | Microsoft Docs) the behavior described above works when the password is change from Azure AD and synced back to on-premise AD.
It should be right (please, can someone else confirm that ?)
I hope I was clear.
Bye,
Luca
Thanks for detailing this step by step and it is helpful!
A question on this to get further more clarity - After implementing all this policy changes what happens the next time when a user resets his password and it is synced to AzureAD via AD sync tool ?
Is it expected that the "PasswordPolicies" attribute again going back to "DisablePasswordExpiration" so that against each password sync the "PasswordPolicies" attribute to be set as "None" using a daily script or something ?
