Password Expiration Issue in Hybrid Active Directory Setup

Question

Our organization has an on-premises Active Directory (AD) integrated with Azure AD Connect and Single Sign-On (SSO) configured, including the password write-back option. We've set a password expiration policy of 90 days at the organizational level in both Office 365 and the on-premises AD Group Policy.

However, I've observed an issue where some users, primarily working from home and not regularly connecting to the official network, are still able to access their email and log into Outlook beyond the 90-day password expiration limit. According to our configuration, they should be prompted to reset their passwords or face login restrictions upon expiration.

Could anyone help me understand the possible root cause of this behavior and suggest steps to resolve the issue?

Answer 1

You can enable that here:

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization#cloudpasswordpolicyforpasswordsyncedusersenabled

However read all the caveats and understand the implications.

I would recommend that instead of expiring passwords, you enable a passwordless MFA architecture and do not expire passwords, instead only disable an account on-prem when the user is leaving the company.