Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Hybrid joined system password reset is not happening
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(224.00000000000003, 84%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Senthilvel Sundaravel
0
Reputation points
Dear Team,
We have set up Entra Connect sync from on-premises Active Directory to Microsoft 365, with password writeback enabled and devices configured as Hybrid Azure AD Joined.
When we reset a user’s password either in on-premises Active Directory or via the Microsoft 365 portal, the user can sign in successfully with the new password while connected to the office network.
However, when the user is on a public network, they are unable to sign in using the new password and can still log in with the old password.
Please advise how to resolve this issue and ensure password changes work consistently from all networks.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 99%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Rukmini 24,365 Reputation points Microsoft External Staff Moderator2026-01-22T09:50:36.7666667+00:00 Hey Senthilvel! It sounds like you're running into some issues with password resets for users in a Hybrid Azure AD Joined environment. Here’s a breakdown of what might be causing the problem and some steps to troubleshoot and resolve it.
Issue Summary
When users reset their passwords, they are able to log in with the new password on the office network, but it seems they can still log in with the old password when connected to a public network. This inconsistency can often be attributed to how password writeback and device authentication are configured in a hybrid environment.
Troubleshooting Steps
- Network Connectivity:
- Ensure that devices on public networks can reach essential Microsoft resources. Check if they can connect to:
-
https://login.microsoftonline.com -
https://enterpriseregistration.windows.net
-
- Run a command prompt and use
pingorcurlto test connectivity.
- Ensure that devices on public networks can reach essential Microsoft resources. Check if they can connect to:
- Firewall Configuration:
- Verify firewall settings to ensure that outbound traffic to the aforementioned endpoints is allowed without intervention or inspection. Misconfigured firewalls can block necessary communications for authentication.
- Check Device Registration:
- Use the command
dsregcmd /statusto obtain the device registration status. This can help identify if the device is properly registered with Azure AD.
- Use the command
- Service Connection Point (SCP):
- Confirm that the Service Connection Point is correctly configured in your on-premises AD. This includes verifying that it contains the verified domain name and correct tenant ID.
- Seamless Single Sign-On (SSO):
- If you're using seamless SSO, make sure that
https://autologon.microsoftazuread-sso.comis added to the intranet settings in Internet Explorer (IE).
- If you're using seamless SSO, make sure that
- Troubleshoot Errors in Event Viewer:
- Check the Microsoft Entra logs (Event IDs 1081, 1088, etc.) for any authentication failures or misconfigurations.
- Re-register the Device:
- If the device appears to be improperly registered, consider deleting the device object from Azure AD and re-registering by running
dsregcmd /join.
- If the device appears to be improperly registered, consider deleting the device object from Azure AD and re-registering by running
Additional Checks
- Temporary Password Issues: Sometimes, the temporary password generated might not be propagated quickly to all systems. Ensure user logins and password resets are configured for proper synchronization.
- Self-Service Password Reset (SSPR) Configuration: If users are relying on SSPR, check its configuration to ensure there are no connectivity issues or policy violations that could affect password resets.
Follow-Up Questions
To help further diagnose the issue, could you provide:
- Are there specific error messages when users attempt to log in on public networks after a password change?
- What kind of network are users on when the issue occurs (e.g., hotel WiFi, public café)?
- Have you verified if the users' devices have the latest updates installed?
- Are there any specific settings or configurations applied to devices when connected to the public network versus the office network?
References
- Troubleshoot Microsoft Entra hybrid joined devices
- Hybrid Azure Join Troubleshooting Guide
- Enable password hash sync
Hope this helps! Let me know if you need more guidance.
Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
- Network Connectivity:
-
Senthilvel Sundaravel 0 Reputation points
2026-01-22T10:48:39.52+00:00 The above steps already tried no luck. I want to know when admin reset the password either AD or portal. hybrid join will support to allow new password login workstation without VPN or any other requirements.
Sign in to comment
Sign in to answer