Need to enable Password Writeback and also enable EnforceCloudPasswordPolicyForPasswordSyncedUsers

Question

Hello,

Currently, we have the password hash sync enabled since end of last year and I need to enable password writeback in AZ ADConnect and also configure SSPR. Also, "EnforceCloudPasswordPolicyForPasswordSyncedUsers" is not enabled which is allowing end-users to access M365 until on-premise password is changed.

I need some guidance what should be done first:

1. Enable Password Writeback
2. Enable Enforce Cloud Password Policy for password synced users
3. Enable and configure SSPR

Thank you for your time and effort.

Answer 1

What is the password expiration policy set to on-prem?
this is what the setting changes

EnforceCloudPasswordPolicyForPasswordSyncedUsers

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization#enforcecloudpasswordpolicyforpasswordsyncedusers

And really that should have been set before PHS and ensure the Azure AD and on-prem policies match if you do enable

I would actually do step3 first.
Note that in step 2, this could cause a large number of users to get prompted to reset their passwords.

Answer 2

Your order is correct. This walks through the steps in the right order
https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback

Answer 3

Thank you @Andy David - MVP for your feedback. We also have few accounts whose password is set not to expire in that case should I execute the following commands?

ENABLE "Set-MsolDirSyncFeature -feature EnforceCloudPasswordPolicyForPasswordSyncedUsers"

UPDATE PASSWORD POLICIES FOR ALL - "Get-AzureADUser -All $true | Where-Object { $.DirSyncEnabled -eq $true -and $.PasswordPolicies -eq ‘DisablePasswordExpiration’ } | ForEach-Object {
Set-AzureADUser -ObjectId $_.ObjectID -PasswordPolicies None }"

DISABLE PASSWORD EXPIRATION FOR SELECT USERS - "Set-AzureADUser -ObjectID <User Object ID> -PasswordPolicies "DisablePasswordExpiration"

and is the order correct?

Answer 4

Also want to mention when on-premise password is expired users have to change it using RDWeb App Portal (currently) other wise they are able to access any network resources and VPN so once it's changes then it does sync using ADConnect and then they have user new password for M365.