Forum Discussion

SRPfr's avatar
SRPfr
Copper Contributor
Jan 04, 2021

AzureAD Password Policy impact after moving from AADConnec sync to Full cloud

Hi  all,

 

We plan to disable AADconnect dirsync to go full cloud and use only Azure AD.

AD OnPrem domain use a very "light" password policy, less restrictive than Azure AD.

 

AD OnPrem:

- Complexity : Disabled

- Minimum password lenght : 6 characters

 

On Azure AD:

- Complexity : Enabled

- Minimum password lenght : 8 characters

- We use the global setting "password never expire" and default settings.

 

Question:

With the Azure AD global setting "password never expire" : when all users go "Cloud Only" there will be no impact, right ?

Even if they have only a 6 characters password without complexity, they can continue to use this password with an Azure AD cloud only account?

 

Thanks !

Azure Active Directory (AAD)
Azure AD Connect
Password Protection

7 Replies

  • Moe_Kinani's avatar
    Moe_Kinani
    Bronze Contributor
    Jan 05, 2021
    Yes, it forces them to change to at least 8 to comply with AAD.

    Good luck!
    Moe
    • SRPfr's avatar
      SRPfr
      Copper Contributor
      Jan 05, 2021

      Yes but when they will be forced to change the password if Tenant is set with « password never expire » ?

      - what will be the impact for user when he connect the first time with the cloud-only the Azure AD account, with a 6 characters password and the Tenant set with « password never expire » ?

      It’s like an AD Onprem password policy ? : Password Policy only evaluated when the password is changed or expired ?
      -> so no impact for user connexion even if the current password don’t meet the AzureAD password policy ?

      • ChristianBergstrom's avatar
        ChristianBergstrom
        Silver Contributor
        Jan 05, 2021

        Hi, enable SSPR while you’re at it. As for the password if it doesn't meet the policy requirements, the user is prompted to try again.

        https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy

  • ChristianBergstrom's avatar
    ChristianBergstrom
    Silver Contributor
    Jan 04, 2021
    Hi, when leaving AAD Connect and being cloud-only the Azure AD password policy is applied (to all user accounts that are created and managed directly in Azure AD). That is, it will take precedence and you must meet the policy requirements minimum of 8 characters.
    • SRPfr's avatar
      SRPfr
      Copper Contributor
      Jan 05, 2021
      Yes this is right, but :
      - what will be the impact for user when he connect the first time with the cloud-only the Azure AD account, with a 6 characters password and the Tenant set with « password never expire » ?

      It’s like an AD Onprem password policy ? : Password Policy only evaluated when the password is changed or expired ?
      -> so no impact for user connexion even if the current password don’t meet the AzureAD password policy ?

Resources