SOLVED

set password expiry in O365

%3CLINGO-SUB%20id%3D%22lingo-sub-107277%22%20slang%3D%22en-US%22%3Eset%20password%20expiry%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-107277%22%20slang%3D%22en-US%22%3E%3CP%3Ecan%20i%20set%20password%20expiry%20for%20certain%20select%20group%20of%20users%20to%20get%20them%20to%20change%20their%20password%20regularly%20%3F%3C%2FP%3E%3CP%3Ecurrently%2C%20the%20system%20policy%20is%20set%20to%20180%20days%20expiry%20date.%3C%2FP%3E%3CP%3Ebut%20we%20noticed%20that%20some%20users%20did%20not%20changed%20their%20O365%20account%20password.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-107277%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-269665%22%20slang%3D%22en-US%22%3ERe%3A%20set%20password%20expiry%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-269665%22%20slang%3D%22en-US%22%3E%3CP%3EHey%20Christian%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20sounds%20like%20you%20set%20the%20user%20account%20to%20expire%20in%20o365%2C%20then%20changed%20the%20password%20in%20o365%20and%20you%20don't%20have%20Password%20Writeback%20enabled%20on%20your%20domain%20(You%20require%20at%20least%20an%20Azure%20AD%20P1%20license%20for%20this%20and%20it%20enabled%20in%20Azure%20Connect%20on%20your%20DC).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20need%20to%20be%20changing%20your%20account%20password%20on-prem%20and%20let%20that%20password%20sync%20to%20o365.%3C%2FP%3E%3CP%3ETo%20change%20on-prem%2C%20log%20onto%20a%20computer%20and%20hit%20ALT%2BCTRL%2BDEL%20then%20click%20CHANGE%20PASSWORD.%20Wait%205%20minutes%20then%20try%20log%20onto%20o365%20with%20your%20new%20password.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20you%20purchase%20an%20o365%20license%20with%20Azure%20AD%20P1%20license%20and%20enable%20Password%20Write%20back%20in%20Azure%20Connect%20then%20you%20can%20force%20password%20changes%20in%20Azure%20like%20you%20did%20and%20that%20should%20work.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENote%20that%20you%2C%20as%20an%20Admin%2C%20changing%20a%20users%20password%20in%20the%20Office%20Portal%2C%20or%20changing%20the%20password%20via%20o365%2Fazure%20powershell%20will%20%3CSTRONG%3ENEVER%3C%2FSTRONG%3E%20write%20the%20password%20back%20to%20your%20onPrem%20network.%3C%2FP%3E%3CP%3EYou%20can%20only%20set%26nbsp%3Bthe%20mandatory%20password%20change%20flag%20in%20the%20cloud%20via%26nbsp%3B%3CSPAN%3Ethe%20Office%20Portal%2C%20or%20via%20o365%2Fazure%20powershell%20%3C%2FSPAN%3Eand%20get%20the%20user%20to%20change%20their%20own%20password%20at%20next%20login%2C%20using%20the%20Change%20Password%20link%20on%20any%20o365%20site%2Fapplication%20or%20via%20the%20SSPR%20(Self%20Service%20Password%20Reset)%20site.%20Only%20the%20last%203%20methods%20will%20write%20the%20password%20back%20to%20the%20OnPrem%20AD%20server.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E(Current%20as%20of%20OCTOBER%202018)%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-253821%22%20slang%3D%22en-US%22%3ERe%3A%20set%20password%20expiry%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-253821%22%20slang%3D%22en-US%22%3Ehi%2C%20I%20tested%20a%20user%20in%20active%20directory%20on%20premise.%20I%20set%20the%20mandatory%20password%20change%20at%20the%20next%20user%20login%2C%20with%20powershell%20on%20O365.%20Then%20I%20tried%20to%20log%20in%20to%20O365%20and%20rightly%20asked%20me%20to%20change%20my%20password.%20Then%20I%20synchronized%20the%20password%20between%20AD%20and%20O365%20(my%20synchronization%20works%20only%20from%20AD%20to%20O365)%20I%20would%20have%20expected%20to%20access%20O365%20with%20the%20password%20of%20the%20user%20set%20in%20AD%20instead%20it%20is%20not.%20To%20log%20in%20I%20must%20use%20the%20previous%20password%20reset%20with%20the%20Powershell%20command%20on%20O365.%20In%20active%20directory%20instead%20I%20log%20in%20with%20the%20old%20password.%20Is%20it%20right%20that%20it%20works%20like%20this%20or%20is%20there%20some%20configuration%20error%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-215952%22%20slang%3D%22en-US%22%3ERe%3A%20set%20password%20expiry%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-215952%22%20slang%3D%22en-US%22%3E%3CP%3EYes%2C%20I%20have%20password%20Sync%20enabled.%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20very%20much%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-215949%22%20slang%3D%22en-US%22%3ERe%3A%20set%20password%20expiry%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-215949%22%20slang%3D%22en-US%22%3E%3CP%3EDo%20you%20have%20also%20the%20password%20sync%20enabled%3F%20If%20so%2C%20all%20password%20policies%26nbsp%3Bare%20managed%20in%20on-prem%20AD%20and%20O365%20expiration%20rules%20etc.%20do%20not%20apply%20for%20synced%20users.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-215941%22%20slang%3D%22en-US%22%3ERe%3A%20set%20password%20expiry%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-215941%22%20slang%3D%22en-US%22%3E%3CP%3EOk%2C%20thank%20you%20very%20much.%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22%22%3EI%20have%20a%20hybrid%20configuration%20in%20the%20company.%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22%22%3EUsers%20on%20premise%20with%20ADSync%20synchronization%20in%20Office%20365%20and%20users%20who%20only%20have%20cloud%20mail%20in%20O365.%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22%22%3EI%20need%20to%20set%20the%20GPOs%20for%20password%20expiration%20in%20active%20directory%20and%20also%20expire%20users%20who%20are%20on%20the%20cloud.%3C%2FSPAN%3E%20%3CSPAN%20class%3D%22%22%3EBy%20setting%20the%20password%20expiration%20on%20the%20cloud%2C%20do%20I%20conflict%20that%20the%20gpo%20I%20have%20set%20in%20active%20directory%3F%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22%22%3EI%20understand%20that%20cloud%20users%20take%20the%20password%20expiration%20rule%20from%20Office%20365%2C%20in%20the%20security%20and%20privacy%20section%2C%20while%20an%20on-premise%20user%20who%20has%20the%20GPOs%20in%20AD%20set%2C%20also%20acquires%20the%20password%20expiration%20rules%20that%20are%20in%20O365%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-215918%22%20slang%3D%22en-US%22%3ERe%3A%20set%20password%20expiry%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-215918%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20can%20set%20the%20password%20to%20never%20expire%20for%20a%20single%20user%20using%20the%20following%20PowerShell%20command%3A%3C%2FP%3E%3CPRE%3ESet-MsolUser%20-UserPrincipalName%20%26lt%3Byour%20user%26gt%3B%20-PasswordNeverExpires%20%24true%3C%2FPRE%3E%3CP%3ETo%20force%20a%20single%20user%20to%20change%20the%20password%20during%20the%20next%20login%2C%20use%20the%20following%20command%3A%3C%2FP%3E%3CPRE%3ESet-MsolUserPassword%20-UserPrincipalName%20%26lt%3Byour%20user%26gt%3B%20-ForceChangePassword%20%24true%3C%2FPRE%3E%3CP%3EPlease%20note%20that%20these%20commands%20only%20affects%20the%20users%20whose%20passwords%20are%20in%20the%20cloud.%20I.e.%20you%20are%20not%20using%20password%20hash%20sync%2C%20federated%20identity%2C%20passthru%20authentication%2C%20etc.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-215380%22%20slang%3D%22en-US%22%3ERe%3A%20set%20password%20expiry%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-215380%22%20slang%3D%22en-US%22%3EIs%20possible%20to%20set%20password%20expired%20and%20not%20PasswordNeverExpires%20for%20single%20user%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-107299%22%20slang%3D%22en-US%22%3ERe%3A%20set%20password%20expiry%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-107299%22%20slang%3D%22en-US%22%3EAgree...PS%20is%20the%20answer%20here!%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-107280%22%20slang%3D%22en-US%22%3ERe%3A%20set%20password%20expiry%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-107280%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20you%20set%20password%20expiry%20in%20O365%2C%20it%20will%20apply%20to%20all%20users.%20What%20you%20need%20to%20do%20to%20exempt%20is%20to%20set%20individual%20users%20password%20to%20never%20expire.%20You%20can%20do%20this%20via%20Powershell%3A%20%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FSet-an-individual-user-s-password-to-never-expire-f493e3af-e1d8-4668-9211-230c245a0466%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FSet-an-individual-user-s-password-to-never-expire-f493e3af-e1d8-4668-9211-230c245a0466%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAlso%2C%20you%20can%20set%20all%20users%20first%20to%20never%20expire%2C%3C%2FP%3E%3CP%3EGet-MSOLUser%20%7C%20Set-MSOLUser%20-PasswordNeverExpires%20%24true%3C%2FP%3E%3CP%3Ethen%20change%20individually%20selected%20users%20to%20password%20that%20expires.%3C%2FP%3E%3CP%3ESet-MSOLUser%20-UserPrincipalName%20%3CALIAS%3E%20-PasswordNeverExpires%20%24false%3C%2FALIAS%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

can i set password expiry for certain select group of users to get them to change their password regularly ?

currently, the system policy is set to 180 days expiry date.

but we noticed that some users did not changed their O365 account password.

 

9 Replies
Highlighted
Solution

If you set password expiry in O365, it will apply to all users. What you need to do to exempt is to set individual users password to never expire. You can do this via Powershell: https://support.office.com/en-us/article/Set-an-individual-user-s-password-to-never-expire-f493e3af-...

 

Also, you can set all users first to never expire,

Get-MSOLUser | Set-MSOLUser -PasswordNeverExpires $true

then change individually selected users to password that expires.

Set-MSOLUser -UserPrincipalName <alias> -PasswordNeverExpires $false

 

Highlighted
Agree...PS is the answer here!
Highlighted
Is possible to set password expired and not PasswordNeverExpires for single user?
Highlighted

You can set the password to never expire for a single user using the following PowerShell command:

Set-MsolUser -UserPrincipalName <your user> -PasswordNeverExpires $true

To force a single user to change the password during the next login, use the following command:

Set-MsolUserPassword -UserPrincipalName <your user> -ForceChangePassword $true

Please note that these commands only affects the users whose passwords are in the cloud. I.e. you are not using password hash sync, federated identity, passthru authentication, etc.  

Highlighted

Ok, thank you very much. 

I have a hybrid configuration in the company. Users on premise with ADSync synchronization in Office 365 and users who only have cloud mail in O365.
I need to set the GPOs for password expiration in active directory and also expire users who are on the cloud. By setting the password expiration on the cloud, do I conflict that the gpo I have set in active directory?
I understand that cloud users take the password expiration rule from Office 365, in the security and privacy section, while an on-premise user who has the GPOs in AD set, also acquires the password expiration rules that are in O365?

 

Highlighted

Do you have also the password sync enabled? If so, all password policies are managed in on-prem AD and O365 expiration rules etc. do not apply for synced users.

Highlighted

Yes, I have password Sync enabled. 

Thank you very much

 

Highlighted
hi, I tested a user in active directory on premise. I set the mandatory password change at the next user login, with powershell on O365. Then I tried to log in to O365 and rightly asked me to change my password. Then I synchronized the password between AD and O365 (my synchronization works only from AD to O365) I would have expected to access O365 with the password of the user set in AD instead it is not. To log in I must use the previous password reset with the Powershell command on O365. In active directory instead I log in with the old password. Is it right that it works like this or is there some configuration error?
Highlighted

Hey Christian,

 

It sounds like you set the user account to expire in o365, then changed the password in o365 and you don't have Password Writeback enabled on your domain (You require at least an Azure AD P1 license for this and it enabled in Azure Connect on your DC).

 

You need to be changing your account password on-prem and let that password sync to o365.

To change on-prem, log onto a computer and hit ALT+CTRL+DEL then click CHANGE PASSWORD. Wait 5 minutes then try log onto o365 with your new password.

 

If you purchase an o365 license with Azure AD P1 license and enable Password Write back in Azure Connect then you can force password changes in Azure like you did and that should work.

 

Note that you, as an Admin, changing a users password in the Office Portal, or changing the password via o365/azure powershell will NEVER write the password back to your onPrem network.

You can only set the mandatory password change flag in the cloud via the Office Portal, or via o365/azure powershell and get the user to change their own password at next login, using the Change Password link on any o365 site/application or via the SSPR (Self Service Password Reset) site. Only the last 3 methods will write the password back to the OnPrem AD server.

 

(Current as of OCTOBER 2018)