How to block authentication of users whose expirydate is in the past

Question

Hi Team,

In our environment, users are created in On-Prem AD and synchronized to EntraID.

When the expiry date of AD account is in the past, onPrem AD is blocking the users from authentication. I understand that this is AD functionality.

We would like to block the authentication in EntraID as well if the expirydate(on-Prem attribute) is in the past. Please let me know what the best approach should be to achieve this.

Thanks

Divya M

Answer 1

Hi Divya M ,

This behavior is expected in hybrid environments. Even if the account is expired in on-prem AD, Microsoft Entra ID does not evaluate the accountExpires attribute during authentication, so users can still sign in to cloud applications.

To achieve your requirement without disabling the account, the recommended approach is to convert the expiry condition into an access control decision using attribute sync, automation, and policy enforcement. First, ensure that the accountExpires attribute is synchronized from on-prem AD to Entra ID using Microsoft Entra Connect, typically by mapping it to an extension attribute. Next, implement a scheduled automation (PowerShell or Azure Automation) that compares the expiry date with the current date and identifies users whose accounts have expired. These users should then be added to a dedicated security group (for example, “Expired-Users”), which will be used for access control.

You can implement this using the following steps:

1. Sync the accountExpires attribute to Entra ID (via Entra Connect → extension attribute).
2. Create a security group (e.g., “Expired-Users”).
3. Configure a scheduled script to:
   • Read user expiry values
   • Compare with current date
   • Add expired users to the group (and optionally remove if updated)
4. Create a policy in Conditional Access:
   • Target → Expired-Users group
   • Cloud apps → All apps
   • Grant → Block access

With this setup, users whose accounts are expired in AD will be automatically identified and blocked from authenticating in Entra ID without disabling their accounts.

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, please "Accept the answer" and kindly "Upvote" it. If you have extra questions about this answer, please click "Comment".