How can i forceChangePasswordNextSignIn for microsoft entra external id?

Question

How can i forceChangePasswordNextSignIn for microsoft entra external id?

Go-Ops 20

Hi @team,

I'm currently attempting to enforce a password change for a user on their next sign-in using the Microsoft Graph API. However, the PATCH request doesn't appear to take effect.

API Endpoint: https://graph.microsoft.com/v1.0/users/<user-id>

Method: PATCH

Request Body:

{
      "passwordProfile": {
        "forceChangePasswordNextSignIn": true
    }
}

Response: HTTP 204 No Content

Issue: Despite receiving a 204 response, the user is not being prompted to change their password at sign-in.

Has anyone encountered this before or have insights into what might be missing?

I have tried the similar API using the cmdlet, and it seems to work correctly
Update-MgUser -UserId "<user-id>" -PasswordProfile @{ forceChangePasswordNextSignIn = $true }

Anonymous

2025-08-14T05:38:25.0866667+00:00

Hi @Go-Ops,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Anonymous

2025-08-18T05:05:47.3266667+00:00

Hi @Go-Ops,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

1 answer

Your answer

Anonymous

2025-08-14T05:38:25.0866667+00:00

Hi @Go-Ops,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Anonymous

2025-08-18T05:05:47.3266667+00:00

Hi @Go-Ops,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Anonymous

Hi @Go-Ops,

Thank you for posting your query on Microsoft Q&A.

As per our understanding, you’re trying to force a user to change their password at the next sign-in using the Microsoft Graph API by setting the forceChangePasswordNextSignIn property. While the API returns a successful response (HTTP 204), the user is not prompted to change their password.

This behavior typically happens when the user you are updating is not a regular, cloud-managed user (known as a "Member" in Microsoft Entra ID), but instead is a Guest or part of an External ID/B2C sign-in flow. These types of accounts don't have passwords stored in your tenant, So while your request is accepted, the setting is ignored behind the scenes.

Please refer to: https://techcommunity.microsoft.com/discussions/officegraph/permissions-required-to-update-password/3978494

Please try the steps below:
Check the User Type

Run the following Graph API to check the user's type:

GET https://graph.microsoft.com/v1.0/users/{user-id}?$select=userType

If userType = Member → you can manage their password.

If userType = Guest → password is managed by their home tenant/provider and can’t be changed from your side.

For Cloud-only (Member) Users

Patch:

json

{ "passwordProfile": { "forceChangePasswordNextSignIn": true } }

You may include a new password in the same request if needed.

Confirm headers are set correctly (Content-Type: application/json, valid token).

This should work if the user is fully managed in your directory.

For Guest / External / Federated Users

You can’t force password changes from your tenant because these accounts are authenticated via their home identity provider (like Google, Facebook, or their own Entra tenant).

These users must change their password through their original provider’s process.

If you're syncing identities from on-premises AD using Azure AD Connect, consider enabling Self-Service Password Reset (SSPR) with password writeback.

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Go-Ops 20 Reputation points

2025-08-20T09:07:55.2433333+00:00
Hi @Anonymous ,

Thank you for your detailed explanation. We can confirm that the user type is a "member". We have also experimented with a few scenarios.

Scenario 1: If i trigger the API using the following example with "password", the user is prompted to change their password.

{ "passwordProfile": { "forceChangePasswordNextSignIn": true, "password": "P@$@woad2203q" } }

Scenario 2: if i trigger the API using the following example without the "password" details, the user is not prompted to change their password

{ "passwordProfile": { "forceChangePasswordNextSignIn": true } }

Scenario 3: if i trigger using cmdlet, to force change forceChangePasswordNextSignIn. The user is prompted to change their password.

Update-MgUser -UserId "<user-id>" -PasswordProfile @{ forceChangePasswordNextSignIn = $true }

Requirement:
We would like to force user to change their password using Microsoft Graph API without updating their existing password. (would like scenario 2 to work)
Anonymous

2025-08-21T10:01:27.1866667+00:00
Hi Go-Ops,

Thank you for posting your query on Microsoft Q&A.

You want to force a user to change their password at next sign-in using Microsoft Graph API by setting "forceChangePasswordNextSignIn": true without updating the current password. You noted:

Microsoft Graph API behavior currently requires a password change operation (i.e., resetting the password value) accompanied by "forceChangePasswordNextSignIn": true to properly prompt the password change flow for cloud-only member users. If you only set "forceChangePasswordNextSignIn": true without providing a new password value, the API does accept the request (HTTP 204), but the user is not prompted because no password change was triggered.

The PowerShell cmdlet Update-MgUser internally handles this differently—it forces the flag in combination with the existing password or uses a different mechanism, so the prompt works without needing to specify a new password.

Try the pattern below in Microsoft Graph API

To force a user to change their password at next sign-in using Microsoft Graph REST API, you must provide a new password along with the forceChangePasswordNextSignIn flag in the JSON passwordProfile.

Simply setting forceChangePasswordNextSignIn to true without changing the password does not reliably trigger the prompt.

Example supported PATCH request that works:

json

{

"passwordProfile": {

"password": "<new-password>",

"forceChangePasswordNextSignIn": true

}

}

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.
Anonymous

2025-08-22T08:36:35.1333333+00:00

Hi Go-Ops,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Go-Ops 20 Reputation points

2025-08-25T07:31:05.8966667+00:00
Hi @Praveen Chivarla,

Thank you for the answer. But the answer that you have given me is repeating what i have explained. Could please provide me the details why is there such inconsistency?

I believe a standardised implementation, whether through cmdlets or APIs is important. This would greatly improve the product’s usability and ease of understanding.

One of our customer requirement is (I am very sure other customer has similar requirement):

Change user password after 90 days policy without providing a new temporary password for seamless password renewal
Anonymous

2025-08-25T10:57:06.1266667+00:00
Hi Go-Ops,

Thank you for following up and sharing your concern.

The reason for the inconsistency is that Microsoft Graph API and PowerShell cmdlets talk to Azure in slightly different ways, and don't always work the same behind the scenes, even if they look similar to us as users.

With PowerShell: You can set “force the user to change password at next sign-in” without changing their password, and it works.

With Microsoft Graph API: You need to set both a new password and the “force change” flag, otherwise the force change alone doesn’t take effect.

This difference is just how Microsoft built the two tools. It’s confusing, but at the moment, that’s the way it is. It’s something that admins and developers have noticed and even given feedback to Microsoft about.

For password expiry and renewal every 90 days:

You don’t need to use the API or PowerShell at all for regular password renewal. Azure takes care of this automatically if you set up password policies. When a user’s password gets too old, Azure will automatically ask them to set a new password the next time they sign in, no extra script, API, or admin work is needed.

If you want to force a one-time password change as admin, use PowerShell (it can do it directly) or Graph API (but only if you set a new temp password).

If you want passwords to expire every X days, use Azure’s password policy settings; users will be prompted to change their password automatically.

If you’d like, I can show you how to set this policy for your users in Azure.

References:

Entra ID password policy docs

Microsoft Graph API: Update user password

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.
Anonymous

2025-08-26T10:29:33.9+00:00

Hi Go-Ops,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Go-Ops 20 Reputation points

2025-08-26T13:33:01.92+00:00

Hi @Anonymous ,

Thank you for your response. I genuinely hope Microsoft addresses the inconsistency soon, as it can be quite frustrating to navigate - especially when working with Microsoft Entra External ID. The available resources often feel disorganized and unclear.

For password expiry and renewal every 90 days:

Could you please provide the steps to achieve this using Microsoft Entra External ID? From my understanding Microsoft Entra External ID does not offer all the features available in Microsoft Entra ID.

Requirement:
Change user password after 90 days policy without providing a new temporary password for seamless password renewal

Pass criteria:
Users logging in 90 days after their last password change will be required to reset their password..

Thanks again for your patience and kind replies.
Anonymous

2025-08-27T11:08:54.4366667+00:00
Hi Go-Ops,

You want to set up a password expiration policy in Microsoft Entra External ID that forces users to change their password every 90 days when they log in, without needing you to provide a temporary password.

Currently, Microsoft Entra External ID does not have a built-in feature to automatically enforce password expiration like the classic Microsoft Entra ID. However, there are practical ways to support password renewal smoothly for your users.

Please do follow the steps below:

Enable Self-Service Password Reset (SSPR) This lets users reset their passwords anytime without admin help, making it easier for them to update expired or forgotten passwords. To enable SSPR for your users:

Sign in to the Microsoft Entra Admin Center.

Go to Password reset > Properties.

Choose who can use SSPR (all users or selected groups).

Configure Authentication methods (like email, phone) users can use to verify their identity.

Optionally, customize registration and notification settings.

Save your changes.

After this, users can reset their passwords by going to the SSPR portal when needed.

Set Up External Tracking and Alerts Since automatic password expiry isn’t native, track when users last changed passwords outside of Entra External ID. You can set up scripts or use monitoring tools to identify users who have not updated their passwords in over 90 days.

Implement Custom User Flow Logic Use your own sign-in flow or custom policies that check password age on login and prompt users to reset if older than 90 days. This requires more advanced setup and integration.

Manual or Scripted Resets via Microsoft Graph API As a last resort, you can use PowerShell or Graph API to force password resets by setting forceChangePasswordNextSignIn. But this requires providing a temporary password and doesn’t meet the seamless experience you want.

Please refer to:

Enable and manage self-service password reset

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.
Anonymous

2025-08-28T11:07:18.2133333+00:00

Hi Go-Ops,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Anonymous

2025-08-29T08:43:41.19+00:00

Hi Go-Ops,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.