Multiple domains sync to Azure AD

HanakJ 86 Reputation points
2020-11-05T11:28:36.35+00:00

lets say I have two on-premise domains (DomainA.org, domainB.org) and one tenant (domainA.onmicrosoft.com). Both domains are sync thanks to Azure AD Connect, so user from domainA can log to office.com, there is no problem. Hoever user from domainB getting this "Error validating credentials due to invalid username or password.", and when I changed password from portal.office.com for this user from domainB. I can log with this new password, but only to office365 services, its not sync to On-prem.

And another wierd thing is, that I cant change password for users from domainA.

Do You know where the problem is?

Thanks

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,665 questions
0 comments
Accepted answer
  1. AmanpreetSingh-MSFT 56,311 Reputation points
    2020-11-05T13:13:37.017+00:00

    Hi @HanakJ · Thanks for reaching out.

    Checking the "User must change password at next logon" flag on a user object in on-prem Active Directory (AD) may cause this. Forcing a user to change their password on next logon requires a password change at the same time. Azure AD Connect will not pick up the force password change flag by itself; it is supplemental to the detected password change that occurs during password hash sync.

    Support temporary passwords in Azure AD for synchronized users is not enabled by default and is enabled by running the following command on your Azure AD Connect server:

    Set-ADSyncAADCompanyFeature -ForcePasswordChangeOnLogOn $true

    -----------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 142.3K Reputation points MVP
    2020-11-05T12:20:50.927+00:00

    If the domains are being synced to Azure and you want to allow password changes in Azure for on-prem accounts, you need to enable Self Service Password Reset and Password Writeback

    Password WriteBack is enabled in AADConnect

    https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback

    Note the licensing requirements

    https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-licensing