on prem user account and entra ID sync account password expiry

Question

Hello Team,

We need a guidance for enabling the password expiry attribute to sync with Entra ID from on premises.

Currently if the password expires on on prem its not syncing with entra id and user can able to use the old password to access the cloud based apps and new password is used to access the onprem end apps.

So we would like to fix this so need a suggestion to fix this without any impact, We use PHS as well.

you advice and suggestion are highly appreciated thank you.

Answer 1

In a Password Hash Synchronization (PHS) setup, the on-premises password expiration attribute does not sync directly to Microsoft Entra ID. By default, synchronized users in Microsoft Entra ID are set so the cloud password never expires, which is why users can still sign in to cloud apps with an expired on-premises password.

To fix this, enable CloudPasswordPolicyForPasswordSyncedUsersEnabled at the tenant level. This makes Microsoft Entra ID enforce its own password expiration policy for password-synchronized users instead of treating them as non-expiring.

Use Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "OnPremDirectorySynchronization.ReadWrite.All"

$OnPremSync = Get-MgDirectoryOnPremiseSynchronization
$OnPremSync.Features.CloudPasswordPolicyForPasswordSyncedUsersEnabled = $true

Update-MgDirectoryOnPremiseSynchronization `
  -OnPremisesDirectorySynchronizationId $OnPremSync.Id `
  -Features $OnPremSync.Features

Important points before enabling it:

1. Password expiration values are still separate between on-premises AD and Microsoft Entra ID. The setting does not sync the on-prem expiration date itself.
2. Authentication location matters:
   • On-premises sign-in uses the on-prem AD password expiration policy.
   • Cloud sign-in to Microsoft 365 or Azure portal uses the Microsoft Entra ID password expiration policy.
3. To avoid user confusion and reduce impact, configure the same password validity period in both on-premises AD and Microsoft Entra ID.
4. If users must be able to change expired passwords from Microsoft Entra ID, password writeback must also be enabled in Microsoft Entra Connect.
5. Existing synchronized users do not immediately lose the DisablePasswordExpiration setting when this feature is enabled. That value is removed on the next password hash sync after each user changes their password on-premises.

If the Microsoft Entra password policy must match the on-premises policy, the domain password validity period in Microsoft Entra ID can be updated with:

Update-MgDomain -DomainId "<domain name>" -PasswordValidityPeriodInDays <Int32> [-PasswordNotificationWindowInDays <Int32>]

Notes:

• Update-MgDomain does not work on federated domains.
• By design, users with an active Microsoft Entra session, refresh token, or passwordless sign-in might not be prompted immediately when the password has expired. The prompt appears when they explicitly authenticate with a password.
• If some synchronized accounts must remain non-expiring, set DisablePasswordExpiration explicitly on those accounts.

This is the lowest-impact approach for a PHS environment because it keeps PHS in place and changes only how Microsoft Entra ID evaluates password expiration for synced users.

---

References:

• Implement password hash synchronization with Microsoft Entra Connect Sync
• Password policy overview and frequently asked questions
• Protect Microsoft 365 from on-premises attacks