Password Hash Sync - Change default password expiry

Question

Password Hash Sync - Change default password expiry

Jon Kilner 136

I'm in in the process of reviewing the steps needed to migrate our ADFS federated domain to be 'managed' in Entra.

One of the differences I've noticed is that by default password hashes for sync'd users do not expire. I've read that we can amend this behaviour by setting CloudPasswordPolicyForPasswordSyncedUsersEnabled to true. With this, once a password is changed on-prem and sync'd to Entra, the hash will expire after 90 days.

My question is, is it possible to change the default 90 days to another number? Our on-prem password expiry is 120 days and I'd like to align the two. The preference would be to set Entra to 120 days as that's what our users are used to.

I appreciate guidance is to move away from password expiry. However, that's not an option for us at the moment.

Obinna Ejidike 2,870 Reputation points Volunteer Moderator

2025-04-28T10:24:51.5733333+00:00

Hi Jon Kilner

Thanks for using the Q&A platform.

You cannot customize the password expiration period for cloud-only or synced users in Entra ID.

When you enable CloudPasswordPolicyForPasswordSyncedUsersEnabled = True, the default Entra password policy applies a 90-day expiration and a 14-day warning before expiry.

Microsoft does not allow you to modify the 90-day limit in Entra, even if your on-premises password policy is 120 days, Entra will still enforce 90 days if the cloud password policy is applied.

Find Microsoft documentation: https://docs.azure.cn/en-us/entra/identity/authentication/concept-password-ban-bad-combined-policy
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization#cloudpasswordpolicyforpasswordsyncedusersenabled

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Obinna.
Jon Kilner 136 Reputation points

2025-04-28T10:58:43.8233333+00:00

Hi @Obinna Ejidike , one of the links you've provided contradicts your answer:

"Entra password policy doesn't apply to user accounts synchronized from an on-premises AD DS environment using Microsoft Entra Connect unless you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers. If EnforceCloudPasswordPolicyForPasswordSyncedUsers and password writeback are enabled, Microsoft Entra password expiration policy applies"

Password expiry duration: The value is configurable by using the Update-MgDomain cmdlet
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2025-04-30T14:31:28.7633333+00:00

Hello @Jon Kilner
Following up to see if the suggestion was helpful. And, if you have any further query do let us know.

Answer accepted by question author

Harshitha Eligeti 4,530 Microsoft External Staff Moderator

Hello @Jon Kilner
I understand that you are process of reviewing the steps needed to migrate our ADFS federated domain to Entra. One key difference is that password hashes for synced users don’t expire by default. However, enabling CloudPasswordPolicyForPasswordSyncedUsersEnabled makes the hash expire after 90 days once synced, aligning with our on-premises policy. Currently, our on-prem password expiration is 120 days, and you'd like to match that. But enabling this setting applies Entra’s default 90-day expiration policy.

If there are synchronized users that only interact with Microsoft Entra integrated services and must also comply with a password expiration policy, you can force them to comply with your Microsoft Entra password expiration policy by enabling the CloudPasswordPolicyForPasswordSyncedUsersEnabled feature (in the deprecated MSOnline PowerShell module it was called EnforceCloudPasswordPolicyForPasswordSyncedUsers.

EnforceCloudPasswordPolicyForPasswordSyncedUsers feature and update the Entra ID password policy to match On-premises Entra password expiry policy. For an example the default Entra ID password policy requires users to change their passwords every 90 days. If your policy in AD is also 90 days, the two policies should match. If the Entra policy is not 90 days, you can update the Entra password policy to match by using the Set-MsolPasswordPolicy PowerShell command. Set-MsolPasswordPolicy -DomainName -ValidityPeriod. Replace with your registered domain name in Azure Entra and with 120 to set the password validity period to 120 days.

In this instance, the password expiry for On-premises and Entra ID will be the same, therefore users will need to change their password when it expires. However, synchronized users won't be able change their password from Entra ID until you enabled Enable Azure Active Directory self-service password reset writeback to an on-premises environment otherwise user has to change their password from on-premises and wait for new Password Hash to get synchronized to Entra ID.

Note: Once EnforceCloudPasswordPolicyForPasswordSyncedUsers feature enabled, Azure AD does not go to each synchronized user to remove the Never Expire (DisablePasswordExpiration) value from the PasswordPolicies attribute. Instead, the Never Expire (DisablePasswordExpiration) value is removed from PasswordPolicies during the next password hash sync for each user, upon their next password change in on-premises AD.

For additional information refer this document: https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization#cloudpasswordpolicyforpasswordsyncedusersenabled

Do Let us know if you have any Queries. We are happy to assist you further

Jon Kilner 136 Reputation points

2025-04-28T15:57:55.43+00:00

Thanks for the additional information @Anonymous

I note you recommend the Set-MsolPasswordPolicy PowerShell command. Is this still valid based on Microsoft deprecating the msol modules?

Would an alternative be to use the following graph command?: Update-MgDomain -DomainId yourdomain.com -PasswordValidityPeriodInDays 120
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2025-04-28T16:47:56.25+00:00

Hello @Jon Kilner
The best approach to change the default password expiry duration for synchronized users in Microsoft Entra. By using the Update-MgDomain PowerShell cmdlet, you can configure the passwordValidityPeriodInDays parameter to set the desired password expiry duration. In your case, you can set it to 120 days to align with your on-premises password expiry policy.
Jon Kilner 136 Reputation points

2025-04-29T08:48:55.8366667+00:00

Will this command work even if we don't have SSPR enabled?

I appreciate this would be a bad user experience, but wondered if there was a pre-requisite for SSPR in order to change the password expiry policy?
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2025-04-29T14:31:08.55+00:00

Hello @Jon Kilner
Regarding your question about whether this command will work even if you don't have Self-Service Password Reset (SSPR) enabled, there is no specific prerequisite for SSPR to change the password expiry policy. However, it is important to note that without SSPR enabled, users will need to change their passwords from the on-premises environment, and the new password hash will then be synchronized to Entra ID.

Do Let us know if you have any Queries. We are happy to assist you further

1 additional answer

Your answer

Obinna Ejidike 2,870 Reputation points Volunteer Moderator

2025-04-28T10:24:51.5733333+00:00

Hi Jon Kilner

Thanks for using the Q&A platform.

You cannot customize the password expiration period for cloud-only or synced users in Entra ID.

When you enable CloudPasswordPolicyForPasswordSyncedUsersEnabled = True, the default Entra password policy applies a 90-day expiration and a 14-day warning before expiry.

Microsoft does not allow you to modify the 90-day limit in Entra, even if your on-premises password policy is 120 days, Entra will still enforce 90 days if the cloud password policy is applied.

Find Microsoft documentation: https://docs.azure.cn/en-us/entra/identity/authentication/concept-password-ban-bad-combined-policy
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization#cloudpasswordpolicyforpasswordsyncedusersenabled

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Obinna.
Jon Kilner 136 Reputation points

2025-04-28T10:58:43.8233333+00:00

Hi @Obinna Ejidike , one of the links you've provided contradicts your answer:

"Entra password policy doesn't apply to user accounts synchronized from an on-premises AD DS environment using Microsoft Entra Connect unless you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers. If EnforceCloudPasswordPolicyForPasswordSyncedUsers and password writeback are enabled, Microsoft Entra password expiration policy applies"

Password expiry duration: The value is configurable by using the Update-MgDomain cmdlet
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2025-04-30T14:31:28.7633333+00:00

Hello @Jon Kilner
Following up to see if the suggestion was helpful. And, if you have any further query do let us know.
Jon Kilner 136 Reputation points

2025-04-28T15:57:55.43+00:00

Thanks for the additional information @Anonymous

I note you recommend the Set-MsolPasswordPolicy PowerShell command. Is this still valid based on Microsoft deprecating the msol modules?

Would an alternative be to use the following graph command?: Update-MgDomain -DomainId yourdomain.com -PasswordValidityPeriodInDays 120
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2025-04-28T16:47:56.25+00:00

Hello @Jon Kilner
The best approach to change the default password expiry duration for synchronized users in Microsoft Entra. By using the Update-MgDomain PowerShell cmdlet, you can configure the passwordValidityPeriodInDays parameter to set the desired password expiry duration. In your case, you can set it to 120 days to align with your on-premises password expiry policy.
Jon Kilner 136 Reputation points

2025-04-29T08:48:55.8366667+00:00

Will this command work even if we don't have SSPR enabled?

I appreciate this would be a bad user experience, but wondered if there was a pre-requisite for SSPR in order to change the password expiry policy?
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2025-04-29T14:31:08.55+00:00

Hello @Jon Kilner
Regarding your question about whether this command will work even if you don't have Self-Service Password Reset (SSPR) enabled, there is no specific prerequisite for SSPR to change the password expiry policy. However, it is important to note that without SSPR enabled, users will need to change their passwords from the on-premises environment, and the new password hash will then be synchronized to Entra ID.

Do Let us know if you have any Queries. We are happy to assist you further

Answer 1

Obinna Ejidike 2,870 Volunteer Moderator

Hello Jon Kilner

Thank you for the feedback.

By default, for synced users, Entra does not enforce any password expiration unless you explicitly enable EnforceCloudPasswordPolicyForPasswordSyncedUsers.
User's image

The Update-MgDomain cmdlet enables you to ensure that both the on-prem and cloud password policies are the same.

If the response was helpful, please feel free to mark it as “Accepted Answer” and consider giving it an upvote. This helps others in the community as well.

Regards,

Obinna.

0 comments