Azure AD Self Service Password Reset - Writeback Problem

Question

I have AAD syncing to AD using the Azure AD connect and sync is working great. I am trying to enable AAD Self Service Password Reset and am getting an error during the password writeback portion.

On my AD controller I get the following error in the Event Logs (EventID 33004)

TrackingId: dde24775-6289-4c16-8293-aa302ddfe8ea, Reason: Synchronization Engine returned an error hr=80230626, message=The password could not be updated because the management agent credentials were denied access

From my research it appears that the MSOL account does not have the appropriate access to reset a password. If I check the effective access for the MSOL account, it clearly shows that the Reset Password permission is not granted.

My question is - how do I grant the Reset Password permission to that MSOL account so it can reset the AD password when a user reset their password using Azure Self Service Password Reset?

Thanks!

Answer 1

Hello @Steve Berg

Your solution is here :

• The Azure AD Connect cloud sync group Managed Service Account should have the following permissions set to writeback the passwords by default:
  • Reset password
  • Write permissions on lockoutTime
  • Write permissions on pwdLastSet
  • Extended rights for "Unexpire Password" on the root object of each domain in that forest, if not already set.
  If these permissions are not set, you can set the PasswordWriteBack permission on the service account by using the Set-AADCloudSyncPermissions cmdlet and on-premises enterprise administrator credentials: PowerShellCopy

   Import-Module ‘C:\\Program Files\\Microsoft Azure AD Connect Provisioning Agent\\Microsoft.CloudSync.Powershell.dll’ 
Set-AADCloudSyncPermissions -PermissionType PasswordWriteBack -EACredential $(Get-Credential)

After you have updated the permissions, it may take up to an hour or more for these permissions to replicate to all the objects in your directory.

• If passwords for some user accounts aren't written back to the on-premises directory, make sure that inheritance isn't disabled for the account in the on-premises AD DS environment. Write permissions for passwords must be applied to descendant objects for the feature to work correctly.
• Password policies in the on-premises AD DS environment may prevent password resets from being correctly processed. If you are testing this feature and want to reset password for users more than once per day, the group policy for Minimum password age must be set to 0. This setting can be found under Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies within gpmc.msc.
• If you update the group policy, wait for the updated policy to replicate, or use the gpupdate /force command.
• For passwords to be changed immediately, Minimum password age must be set to 0. However, if users adhere to the on-premises policies, and the Minimum password age is set to a value greater than zero, password writeback will not work after the on-premises policies are evaluated.

For more information about how to validate or set up the appropriate permissions, see Configure account permissions for Azure AD Connect.

In case you found this answer helpful please mark it as accepted !

Best regards

Answer 2

You can grant the Reset Password permission to the MSOL account by adding it to the "Password Reset Authenticated Users" security group in AD.

Answer 3

@Steve Berg

Looks like the connector account in AD connect doesn't have a proper permissions set in on-premises DC. You will need some permissions to be set for the connector account.

To know what is the connector account that is been used, you can follow below steps.

• Open AD connect wizard.
• Click on view configuration.
• In the page you will see what is the account that is been used to connect to on-premises DC.

You need to have below permissions set on domain level for the new password to be written back.

For more information you can also refer below article,

https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback#configure-account-permissions-for-azure-ad-connect

Do let me know if you have any further questions.