Disable ability for user to change password in Azure AD

%3CLINGO-SUB%20id%3D%22lingo-sub-307820%22%20slang%3D%22en-US%22%3ERe%3A%20Disable%20ability%20for%20user%20to%20change%20password%20in%20Azure%20AD%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-307820%22%20slang%3D%22en-US%22%3E%3CP%3EYes%20there%20is%20a%20way.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere%20it%20is%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fanswers.microsoft.com%2Fen-us%2Fmsoffice%2Fforum%2Fmsoffice_o365admin-mso_manage%2Fdisable-password-changing-option-in-owa-office-365%2F5d5cbf4f-ff7b-47f4-98c5-6e767f6c4524%26nbsp%3B%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fanswers.microsoft.com%2Fen-us%2Fmsoffice%2Fforum%2Fmsoffice_o365admin-mso_manage%2Fdisable-password-changing-option-in-owa-office-365%2F5d5cbf4f-ff7b-47f4-98c5-6e767f6c4524%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-144591%22%20slang%3D%22en-US%22%3ERe%3A%20Disable%20ability%20for%20user%20to%20change%20password%20in%20Azure%20AD%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-144591%22%20slang%3D%22en-US%22%3E%3CP%3ENot%20that's%20%3CA%20href%3D%22https%3A%2F%2Ffeedback.azure.com%2Fforums%2F169401-azure-active-directory%2Fsuggestions%2F9180638-disable-user-s-ability-to-change-password-via-clo%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Enot%20possible%3C%2FA%3E%2C%26nbsp%3Bmight%20not%20help%20but%20you%20could%20change%20the%20expiry%20threshold%26nbsp%3Bto%20its%20maximum%20value%20730%20days%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2Fset-the-password-expiration-policy-for-your-organization-0f54736f-eb22-414c-8273-498a0918678f%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ESet%20the%20password%20expiration%20policy%20for%20your%20organization%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fhelgeklein.com%2Fblog%2F2017%2F01%2Fdisabling-azure-active-directory-password-expiration%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EDisabling%20Azure%20Active%20Directory%20Password%20Expiration%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CP%3EThe%20second%20link%20says%20you%20might%20actually%20be%20able%20to%20increase%20it%20to%26nbsp%3B1%2C000%20days%20with%20PowerShell.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-144569%22%20slang%3D%22en-US%22%3EDisable%20ability%20for%20user%20to%20change%20password%20in%20Azure%20AD%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-144569%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20-%20anyway%20to%20prevent%20an%20Azure%20AD%20cloud%20only%20user%20from%20changing%20their%20password%20-%20like%20you%20could%20do%20on-prem%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Ethanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-144569%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Contributor

Hi - anyway to prevent an Azure AD cloud only user from changing their password - like you could do on-prem?

 

thanks

3 Replies

Not that's not possible, might not help but you could change the expiry threshold to its maximum value 730 days:

 

Set the password expiration policy for your organization

 

Disabling Azure Active Directory Password Expiration

The second link says you might actually be able to increase it to 1,000 days with PowerShell.

@Kamal Bhatt Can confirm that doesn't prevent users from changing their Office 365 account password under "View Account - Change Password".

This may prevent a user from changing their password from within Outlook, but certainly doesn't not prevent them from changing their O365 password. 

Only way I've been able to prevent the password change is to disable Password Writeback on AAD connect. This will generate the "Your organization doesn't allow you to change your password here" when users try to change their password via their Office portal. 

I know then this defeats the purpose of selective password writeback / changing, but that's all I've been able to find so far. 

If anyone else has any other suggestions, I would absolutely love to hear them.