Update-MgUser_UpdateExpanded: The specified password does not comply with password complexity requirements. Please provide a different password. Status: 400 (BadRequest)

Question

I am attempting to use the powershell cmdlet Set-EntraUserPassword to change the password for an account as part of an offboarding sequence.

The script takes a parameter of the e-mail for the account and can successfully get it from EntraID using

$user = Get-EntraUser | where { $_.UserPrincipalName -eq $em }

My code then performs things like disabling the account, querying all the groups the account belongs to and removing the group membership of this account and finally I want to change the password of the account to a random value.

I believe the password I am generating is valid based on this: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy

My code to generate the password and attempt to set it is:

$length=12

$p = -join ((char[] + (char[]) + 0..9 ) | Get-Random -Count $length | % {[char]$_})

$pwd = ConvertTo-SecureString -String $p.ToString() -AsPlainText -Force

Set-EntraUserPassword -ObjectID $em -Password $pwd

When I ran this code it generated a random password of: #3iczO]d\A}y

The code however throws this error and I need to understand why the password is invalid:

Resetting password for account user to #3iczO]d\A}y

Update-MgUser_UpdateExpanded: The specified password does not comply with password complexity requirements. Please provide a different password. Status: 400 (BadRequest)

ErrorCode: Request_BadRequest Date: 2024-10-15T17:57:40 Headers: Cache-Control : no-cache Vary :

Accept-Encoding Strict-Transport-Security : max-age=31536000 request-id : aa24798e-43d2-43be-894a-a6b8bdff939d

client-request-id : 51910791-c35d-4c5f-8b87-28518716e804 x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West

US","Slice":"E","Ring":"4","ScaleUnit":"002","RoleInstance":"BY3PEPF000483E7"}} x-ms-resource-unit : 1 Date :

Tue, 15 Oct 2024 17:57:40 GM

Answer 1

The error you're encountering is likely due to the password not meeting Microsoft Entra ID’s complexity requirements, which specify that passwords must contain characters from at least three categories: uppercase letters, lowercase letters, digits, and special characters.

To ensure the generated password meets these requirements, update your script to include a mix of characters from all necessary categories. Here’s an optimized version of your password generation code:

then This ensures that the password complies with the complexity requirements by including a mix of uppercase, lowercase, digits, and special characters. Double-check your organization's custom password policies if further complexity is needed.

$length = 12
# Ensure the password includes at least one character from each category
$lowercase = (65..90) | ForEach-Object { [char]$_ }
$uppercase = (97..122) | ForEach-Object { [char]$_ }
$digits = (48..57) | ForEach-Object { [char]$_ }
$specialChars = "!@#$%^&*()-_=+[]{}|;:'\",.<>?/`~" -split ""
# Generate the password
$passwordArray = (
    $lowercase + $uppercase + $digits + $specialChars |
    Get-Random -Count $length
)
$password = -join $passwordArray
$securePassword = ConvertTo-SecureString -String $password -AsPlainText -Force
# Set the password
Set-EntraUserPassword -ObjectID $em -Password $securePassword