Prevent users from changing password

Question

Hi,

so...I was wondering if there is a possibility to prevent users from changing password within O365?

One can block that from Exchange Online / OWA it seems via RBAC (http://blogs.technet.com/b/ilvancri/archive/2012/06/22/take-away-the-possibility-for-users-in-exchange-online-to-change-their-own-password.aspx)

The menu is still there right but one get an error message when trying?

How about the profile page under my site within SharePoint?

Answer 1

Hi Ron,

As mentioned above, if users are synced from local domain to Office 365 with ADFS web SSO (Single-Sign On), we can prevent them from changing password in local Active Directory.

However, if users are pure cloud users, in another word, those users are not created in your local Activate Directory, it’s not feasible to prevent them from changing passwords in Office 365 web interface. In this case, I’d like to invite you submit this idea at our UserVoice. Many great features came directly from our customers. Your understanding is highly appreciated.

Regards,

Fraser

Answer 2

Vincent,

We also require the ability to prevent Office 365 user from changing their passwords.  We have nearly 200 licenses using OWA exclusively and have an organizational structure that centers around mailboxes like '*** Email address is removed for privacy ***' or '*** Email address is removed for privacy ***'.

We CANNOT have an employee on one shift change a password, affecting all other shifts for that position.

This is a huge problem for us.

Yes, I know that as an administrator can just change it back... but we don't have IT Admin staff on duty all three shifts.

Like I said, this is a big problem for us.

Can this be fixed?

Answer 3

Hi Frigge,

SharePoint Online is not able to do this as it does not provide authentication functionality, all the authentication job are finished from Office 365 side(Azure AD). At present, it is not feasible to prevent pure cloud users from changing their passwords from Office 365 web interface.

For Dirsync users that are synced from local domain to Office 365 with ADFS web SSO(single-sign on) deployed, we can prevent them from changing password in local Active Directory since the authentication server is still local domain controller.

Let us know if you have any questions.

Best Regards,

Vincent