Azure B2C password reset from Azure Blade provides "The password has expired."

Question

We need some users to have the user Administrator role so they can rest passwords of the consumer account but once the password is reset from the Azure B2C user blade does not work and when logging in with the new supplied password user receives "The password has expired."

What should be the way forward?

Answer 1

Hello @SaqibAhmed-1948

This is expected. When you reset the password using admin account from Azure AD Portal, a temporary password is generated which is marked as expired and requires the user to provide a new password. Since, in B2C there is a different mechanism for resetting password (i.e. by using Password Reset User flows/Custom Policies), users don't get the option to reset the password and only get The password has expired. message. In B2C, administrator accounts cannot be used to reset password of consumer accounts.

You may consider using one of the below custom policies:

• Force password reset first logon
• Force password after 90 days

  ---

Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.

Answer 2

It is possible to set a new password using the following Powershell cmdlet - although this is a workaround that is far from ideal

Connect-AzureAD -TenantId <tenantId>
$Password = ConvertTo-SecureString -String "TheNewPassword" -Force –AsPlainText
Set-AzureADUserPassword -ObjectId <userId> -Password $Password

Answer 3

Thanks for creating the force password reset policy it was very helpful.

However, why the decision to create these json key/values that don't follow a specific graph API schema? we now have to be aware to publish this json property "extension_YOURAPPIDGUIDWITHOUTDASHES_mustResetPassword".

The downstream effects are pretty heavy... for example:

In terms of creating api wrappers, etc this become difficult if it's not part of a schema. Also we lose intellisense and difficult to create documentation for.

In our situation we have a c# class that is serialized and pushed to the API endpoint, we now have to add a property "extension_YOURAPPIDGUIDWITHOUTDASHES_mustResetPassword" (and/or make use of the json property attrib). Even worse if you have mutiple environments / Azure AD applications.

Wouldn't it be cleaner to create a "applicationExtensionAttributes" (as an example) as part of the schema:

{
    "objectId": null,
    "accountEnabled": true,
    "applicationExtensionAttributes": {
        "applications": [{
            "id": "GUID-1",
            "attributes": [{
                    "key": "mustResetPassword",
                    "value": true
                },
                {
                    "key": "whatEverIWant",
                    "value": "can go here"
                }
            ]
        }]
    }
}

Thank you!

Answer 4

I believe the linked Force password reset first logon custom policy in the accepted answer has been mitigated by time?

When enabling Self-service password reset and/or Forced password reset on the user flows, creating new users with this password profile does the job "out of the box" in our scenario:

"passwordProfile": {
        "forceChangePasswordNextSignIn": true,
        "passWord": "1234abCD#"
    }