Entra Cloud Sync: "OnPremisesChangePasswordOnNextLogOnFeatureNotEnabled"

Question

Entra Cloud Sync: "OnPremisesChangePasswordOnNextLogOnFeatureNotEnabled"

Scott Powdrill 20

Hi All,

Having issues with "require user to change password on next logon" propagating from on-premise AD to entra ID via Entra ID cloud sync. When the flag is set it seems to fail (and not propagate the password change) with the error "OnPremisesChangePasswordOnNextLogOnFeatureNotEnabled" in the provisioning logs.

The test user has 2fa enabled and configured.
The minimum Password Age is set to 0 on-prem.
The MSA account has the correct permissions.
SSPR works if initiated within the user's portal.

I'm just getting: OnPremisesChangePasswordOnNextLogOnFeatureNotEnabled in the provisioning logs. Are we sure CloudSync even supports this?

At this point, it seems like I just need to reset the user's password and instruct them to change it. Which is not ideal.

Any help is much appreciated.

Scott

Accepted answer

0 additional answers

Your answer

Answer 1

Navya 17,565 Microsoft External Staff

Hi @Scott PowdrillI'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue:

Entra Cloud Sync: "OnPremisesChangePasswordOnNextLogOnFeatureNotEnabled"

Solution:

Issue resolved by @Scott Powdrill

User's image

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

If you have any other questions, please let me know. Thank you again for your time and patience throughout this issue.

Scott Powdrill 20 Reputation points

2025-04-10T15:23:54.6+00:00

Ive managed to answer this question:

Long story short, if you want to reset a user's password and get them to change it to a new one when they log on with a temporary one that you give them, you need to initiate this from Entra ID.

NB: do not tick the user must change the password on the next logon from the on-premise ad.

A slightly longer story is that the Entra ID cloud sync (at the time of writing) does not pass the change password on the next login flag to Entra ID. If you tick this box, it will not propagate any password change to Entra ID either. If you accidentally do this, you must then reset the password from on-premise without the flag ticked.

The correct way to do this is to initiate any password change from Entra ID itself, from entra ID you can tick the required password change at the next logon flag, and it will work fine.

Share via

Entra Cloud Sync: "OnPremisesChangePasswordOnNextLogOnFeatureNotEnabled"

0 additional answers

Your answer