How to create a dynamic group membership group in Azure AD based on last password change date, please gelp.

Question

How to create a dynamic group membership group in Azure AD based on last password change date, please help.

Answer 1

Thanks for posting your question in the Microsoft Q&A forum.

It should be something like this:

$rule = "UserPasswordLastChangeDate -ge `" + (Get-Date).AddDays(-30).ToString("yyyy-MM-ddTHH:mm:ssZ") + "`"
New-AzureADMSGroup -DisplayName "Password Last Changed in Last 30 Days" -MailEnabled $false -SecurityEnabled $true -GroupTypes "DynamicMembership" -MembershipRule $rule -MembershipRuleProcessingState "On"

https://learn.microsoft.com/en-us/answers/questions/1029231/get-last-password-change-time-stamp-with-graph-pow

https://www.powershellcenter.com/2023/02/03/pwdlastset/

** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful **

Answer 2

You cannot create such dynamic group, as the corresponding property is not supported for dynamic membership queries. This article lists the currently supported properties: https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership#supported-properties

Either use a different property, or create an assigned membership group and update it periodically.