Force password reset as set on AD to cloud access

Question

How can we enforce password resets for domain users who primarily access cloud services and infrequently, if ever, log in to domain-joined devices? While we've implemented AD-based password expiration policies, we're encountering challenges in ensuring that users who primarily interact with cloud services are complying with these policies. Given our hybrid AD/AAD environment, what strategies can be employed to effectively mandate password resets for these users?

Answer 1

HI, you can reference the steps here:

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization#cloudpasswordpolicyforpasswordsyncedusersenabled

Answer 2

Hi @Lesther Escobar

If you sync the password from on-premise to Entra ID, You should set the same value on Maximum password age (password expiry duration) on active directory and Entra ID.

In Entra by default it's 90 days if the tenant created before 2021 and you can adjust it by using the following command

Update-MgDomain

For more information please refer to the following link :

Microsoft Entra password policies

Property	Requirements
Password expiry duration (Maximum password age)	Default value: 90 days. If the tenant was created after 2021, it has no default expiration value. You can check current policy with Get-MgDomain. The value is configurable by using the Update-MgDomain cmdlet from the Microsoft Graph module for PowerShell.
Password expiry (Let passwords never expire)	Default value: false (indicates that passwords have an expiration date). The value can be configured for individual user accounts by using the Update-MgUser cmdlet.

---

Please don't forget to accept helpful answer

---