Users Password expiry notification from Azure

Question

Hi,

Please It is possible to configure users to get Password expiry notifications,

We have Azure AD Connect configured but would like users to get notifications for Password expiry

Answer 1

This is 2021, we have been dealing with inefficient or non-existent password expiration notifications for too long. Someone needs to correct this basic core feature...

Answer 2

Hello @Kingsley Chibundu

Since you have Azure AD Connect configured to sync the User Accounts, and if you have configured Password Sync as well, you would first need to Enforce cloud password policy for Password Synced Users by using below cmdlet:

• Run Connect-MsolService and login with Global Admin account.
• Run Set-MsolDirSyncFeature -Feature EnforceCloudPasswordPolicyForPasswordSyncedUsers -Enable $true to Enforce cloud password policy for Password Synced Users

Set the password validity period and notification days by using below cmdlet:

• Set-MsolPasswordPolicy -ValidityPeriod 60 -NotificationDays 14

This command updates the tenant so that all users passwords expire after 60 days. The users receive notification 14 days prior to that expiry.

-----------------------------------------------------------------------------------------------------------

Please do "Accept the answer" wherever the information provided helps you. This will help others in the community as well.

Answer 3

Also, there may be multiple service accounts which might be present and enabling the password expiry will expire password for those Service accounts as well which will break the applications or what ever the service account is getting used for.

Is there a way to trigger the email notification to ONLY MEMBER ACCOUNTS WHICH HAS EMPLOYEE ID in their Azure AD profile?

Answer 4

It is sad that Microsoft thinks they can call Azure AD an enterprise level solution when they can't include basic, critical features like password expiration notifications in the product set. These answers that side-step the actual issue, question, and desire of customers display a true lack of customer care.

Just because some of your customers can use 3rd party solutions or devise work-arounds doesn't mean your product is providing the functionality that is needed, in fact it is not. Not everyone can utilize these outside solutions - especially not in GCC-High.

There has to be a solution that is not single focused. Why shouldn't we be able to simply enable a password reminder every x days for all cloud-based/AAD-based accounts? Why wouldn't the system enable an option to send a notification x days prior to a pw expiration on all AAD-based accounts regardless of AD Connect status?

Answer 5

The suggested method of enforcing the cloud password policy is not an acceptable answer for hybrid environments using PHS since the on prem password policy is what will most likely be desired; especially if you have fine grained password policies set. That means that despite years of us asking for this to be addressed the only solution to date for hybrid organizations is to either implement a custom script/scheduled task or a third party tool to fill this gap in MS Azure functionality.