Ctrl+Alt+Delete then Change a password then redirect to https://name.domainname.com/adfs/portal/updatepassword/

Question

Hi there. We have on-premises domain and some of computers were migrated to Intune, so now part of the computers are not domain joined but Microsoft Entra joined. Some of users on Microsoft Entra joined computers after pressing Ctrl+Alt+Delete and selecting Change a password are redirected to

https://name.domainname.com/adfs/portal/updatepassword/ and it is :) good, it is how I want to be (they are able to change their passwords). But others users on Microsoft Entra joined computers after pressing Ctrl+Alt+Delete and selecting Change a password are redirected to

https://mysignins.microsoft.com/security-info/password/change ( https://myaccount.microsoft.com/ ) and they can not change passwords because we disabled Write-Back feature. The question is - How to redirect all users on Microsoft Entra joined computers to https://name.domainname.com/adfs/portal/updatepassword/ ? We have not done something special on Microsoft Entra joined computers that are redirected to https://name.domainname.com/adfs/portal/updatepassword/ , first I thought it is by default but then I noticed that some computers are redirected to https://mysignins.microsoft.com/security-info/password/change ( https://myaccount.microsoft.com/ ) May be someone already faced with this issue :)

Answer 1

Hi @Renat Khamzin , ADFS only passes the ADFS Password Change URL in the Saml token to Entra if:

• The relevant claimrule is configured
• Password portal is enabled in ADFS
• The user's password in Active Directory is within 14 days of expiry

Assuming a user signed into their device for the first time, their password is still valid for more than 14 days. ADFS would not emit the URL. In that case Entra passes the Entra Password Portal URL to the device 

The device caches this information and will load Entra Password Portal when the user invokes a PWD change on the device.

Eventually the user may perform a password logon when their password is closing in on the 14 days expiry mark.

The user performs password auth and ADFS adds the URL to the token. Entra will then pass down the ADFS Password Portal URL as part of the PRT. At this time the device updates the cached info and offers the ADFS Portal the next time when attempting a PWD change

Note:

Users that use WHFB for logging into Windows or are on staged rollout for managed auth will rather get the Entra Password Portal because Entra would be the primary authentication authority.

Going forward, for security reasons we would rather recommend to use Entra SSPR with Password Writeback for a number of reasons.

Here's a brief comparison of functionality:

	Change Password	Reset Password	supports SmartLockout	MFA Protection
	Change Password	Reset Password	supports SmartLockout	MFA Protection
ADFS Password Portal
Entra SSPR

 

Besides the Security benefits sticking with one PWD change portal adds to more consistency in the user experience.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

Answer 2

Hello @Renat Khamzin,

Thanks for the prompt response. 

We understand that you are facing issues with some user devices which were migrated to Intune and are joined to azure. As the process of changing their password, some users are being redirected to https://name.domainname.com/adfs/portal/updatepassword/ while some users are being redirected to https://mysignins.microsoft.com/security-info/password/change after pressing Ctrl+Alt+Delete. 

As a part of troubleshooting, we have confirmed that all devices belong to the same domain, they are connected to the same network. Further, you have also confirmed that the Active Directory Federation Services (ADFS) password change page is configured accordingly to redirect the users to the expected page for changing the password. To investigate the issue further, we need to analyze the logs to understand why it is being redirected to another page than the expected ADFS page. If you have a support plan, could you please file a support ticket for deeper investigation and do share the SR# with us? In case you don't have a support plan please let us know here. 

Best Regards

Janaki Kota