Password Change Notification to end user

Sumanth Kavuri 1 Reputation point
2022-08-02T15:25:48.633+00:00

We are having Microsoft Hybrid Setup. We need to send End Users about password change notification to them. User can change his password in AD or In Office 365/Azure. Kindly suggest best way to send end user notification about his password change.

Can we use Microsoft Sentinel for Event ID Based email alert?

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,813 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
971 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,362 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clive Watson 5,711 Reputation points MVP
    2022-08-03T11:52:49.83+00:00

    Maybe build a process from this example, then use a Playbook to send the Email to the user, letting them know the password has expired or needs to be changed and the link to use?

    https://github.com/Azure/Azure-Sentinel/blob/158019e9f69d847f506d2f1ba05af0bad64b66dd/Hunting%20Queries/SecurityEvent/FailedUserLogons.yaml

    0 comments
  2. Sandeep G-MSFT 14,156 Reputation points Microsoft Employee
    2022-08-03T14:07:42.257+00:00

    anonymous user

    Since you have hybrid setup, I am guessing that you are using AD connect to sync users from on-premises to Azure AD. If you are using AD connect and if you have configured Password Sync as well, you would first need to Enforce cloud password policy for Password Synced Users by using below cmdlet,

    • Open PowerShell as administrator.
    • Install the MsOnline module by using command “Install-Module MsOnline”
    • Run command “Connect-MsolService” and enter the global admin credentials of Azure AD.
    • Run below commands,
    • Set-MsolDirSyncFeature -Feature EnforceCloudPasswordPolicyForPasswordSyncedUsers -Enable $true
    • Set-MsolPasswordPolicy -ValidityPeriod 60 -NotificationDays 14 -DomainName <domain name to which you want to apply the policy>
    • next time when user changes the password in onpremise, the user properties in cloud attribute "passwordneverexpires" value will be changed
    to null or false.
    • This will let the users know about password expiry before number of days that is configured as "notificationdays" in above command.

    Do let us know if you have any further questions on this.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments