Comments on: Office 365 – DirSync Password Sync: Did You Know?

By: Joe Palarchio

Joe Palarchio — Thu, 14 Apr 2016 15:26:16 +0000

Patrick-
For the most part, the same limitations still apply today.
I haven’t tested the issue with spaces but that’s a bit of an edge case. To force a sync of passwords, the process is a little different now: https://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnectsync-implement-password-synchronization/. Also, the (non-password) sync cycle is 30 minutes instead of 3 hours in the latest version of AAD Connect.
Thanks!
Joe

By: Patrick Greene

Patrick Greene — Thu, 14 Apr 2016 15:16:47 +0000

Joe,
Are these limitation still in place today with the latest Azure AD Connect?
Thx,
Patrick

By: Fredrik

Fredrik — Wed, 19 Nov 2014 16:41:59 +0000

Great Post. Thank you!

By: Joe Palarchio

Joe Palarchio — Fri, 24 Oct 2014 17:29:29 +0000

In reply to Visokoo.

My thought there was that if you didn’t want users to be able to login with expired credentials, you could change the password in the cloud to an unknown value and the user could no longer use the expired password.
So basically you would run your command but without the -forcepasswordchange switch. You’d also need logic to be able to identify expired passwords on-premises so you’d know who to reset in the cloud.
This would force users to then change their on-premises password which would subsequently sync to the cloud and allow them to login.
Thanks for the feedback!

By: Visokoo

Visokoo — Fri, 24 Oct 2014 17:20:49 +0000

Hi Joe,
Thanks for the great blog post on this.
Would you be able to clarify on how this process would work for this statement:
“As a possible workaround to this, you could develop a script running as a scheduled task that modifies the cloud password via Remote PowerShell based on the on-premises password expiration.”
Would the command line be as simple as:
set-msoluserpassword -userprincipalaname (user) -forcechangepassword $true