PHS remote users change password

[Skipster311-1]

Hello all

We are currently in a hybrid PHS environment. We have SSPR turned on and its working. What i am trying to understand is how do we get "work from home users" to update their password? If they never log into the onprem domain, then the flag “DisablePasswordExpiration”  will never be removed from the Azure AD account. Any advice is greatly appreciated .

[#2]

Hi, have a look at the "EnforceCloudPasswordPolicyForPasswordSyncedUsers".

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchron...

[#3]

Its already turned on, but the flag “DisablePasswordExpiration” on the user account doesnt get removed until the user first changes their password

[#4]

I suppose you didn't enable it before enabling PHS then. And this is configured as well? https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writebac...

[#5]

PHS was enabled first, then we turned on "DisablePasswordExpiration". We have SSPR turned on, and password writeback, but allow "users to unlock accounts without resetting their password" is off. Again what i am trying to understand is how can i handle all of my work from home users ? considering they will never change there password because they never log into the onprem domain

[#6]

@Skipster311-1 As PHS was enabled before the EnforceCloudPasswordPolicyForPasswordSyncedUsers shouldn't forcing a password change solve this scenario considering you already have (1) enabled password writeback in Azure AD Connect and (2) password writeback for SSPR and (3) enabled the EnforceCloudPasswordPolicyForPasswordSyncedUsers (they now comply with Azure AD password expiration policy). When you enable SSPR to use password writeback, users who change or reset their password have that updated password synchronized back to the on-premises AD DS environment as well. Hence the DisablePasswordExpiration value [should] be removed from PasswordPolicies during the next password hash sync.

Just thinking out loud here, haven't used PHS..

@Thijs Lecomte Any input here?

[#7]

I understand what you are saying. i can send out a company email to all remote users to update their password, but i am relying on them to actually follow the instructions and request, which is not always a simple process. I'm assuming i can force the remote users to change their password by removing the "DisablePasswordExpiration" from the account, which would immediately expire the password based on the current age of the users password

[#8]

Hi Skip,

I have written a blogpost in the past about this feature, let me know if you still have some questions after reading the blog article: https://www.bilalelhaddouchi.nl/index.php/2020/09/24/comply-your-ad-password-expiration-policy-with-...

[#9]

What do you mean by "hybrid PHS environment"? Are your users devices Azure AD Hybrid Joined or Azure AD Joined? Is your domain managed or federated? How do they normally change their passwords? Ctrl-Alt-Del?