Hybrid AD password policy

Question

Hello all,

Currently we use hybrid AD (onprem and Entra ID), we use PHS and sync the hashes via entra connect. When the user password expires in onprem users cannot access any resources in on premise as expected but users can accesss the cloud based apps with the expired password, We notcied the password expiry attrbute cannot be sync what is the better way to adddress this issue.

Answer 1

This is expected (with PHS). Entra Connect transfers the password hash to Microsoft Entra ID, but the subsequent cloud authentication does not contact your domain controllers. Microsoft Entra therefore has no real-time knowledge of whether the AD password has subsequently expired or whether the on-premises account has reached its accountExpires date. accountExpires is not synchronized by Entra Connect.

If you require cloud sign-in to respect the current state of the on-premises password, Pass-through Authentication is the cleaner solution. PTA sends the authentication request through the PTA agent to on-premises AD, allowing AD to make the decision about password validity and account lockout. This means an expired password or locked account can prevent authentication to Microsoft 365 and other Entra-integrated applications. The downside is that authentication now depends on your on-premises PTA infrastructure, so you should deploy multiple agents and consider the resilience implications before making the change.

If you want to keep PHS, you can instead configure Microsoft Entra to apply a password lifetime to synchronized users. Enable CloudPasswordPolicyForPasswordSyncedUsersEnabled and configure the password-validity period on the Entra domain to correspond with your AD policy:

Connect-MgGraph -Scopes "OnPremDirectorySynchronization.ReadWrite.All"

$sync = Get-MgDirectoryOnPremiseSynchronization
$sync.Features.CloudPasswordPolicyForPasswordSyncedUsersEnabled = $true

Update-MgDirectoryOnPremiseSynchronization `
    -OnPremisesDirectorySynchronizationId $sync.Id `
    -Features $sync.Features    

Then configure the domain:

Update-MgDomain `
    -DomainId "<domain name>" `
    -PasswordValidityPeriodInDays <days> `
    -PasswordNotificationWindowInDays <days>

There is a timing consideration with this approach. For users who are already synchronized, the change does not alter their existing password-expiration setting. The relevant user state is updated following a subsequent password change and password-hash synchronization.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

With Password Hash Synchronization, this behavior is by design.

• Password Hash Synchronization depends on on-premises AD only during synchronization, not during authentication.
• The accountExpires attribute is not synchronized to Microsoft Entra ID.
• As a result, an expired on-premises AD account can still be active in Microsoft Entra ID and continue to access cloud apps.

Better ways to address it:

1. Use Pass-through Authentication (PTA) instead of PHS if immediate enforcement of on-premises password expiration and lockout is required for cloud sign-ins. PTA validates the username and password against on-premises Active Directory during authentication, so on-prem AD lockouts and password expiration are enforced for Microsoft 365 and other cloud sign-ins.
2. If staying on PHS, align cloud password expiration with on-premises policy by enabling CloudPasswordPolicyForPasswordSyncedUsersEnabled and setting the Microsoft Entra password policy for each domain to match the on-premises expiration period.
   • Enable the feature:

      Connect-MgGraph -Scopes "OnPremDirectorySynchronization.ReadWrite.All"
      
      $OnPremSync = Get-MgDirectoryOnPremiseSynchronization
      $OnPremSync.Features.CloudPasswordPolicyForPasswordSyncedUsersEnabled = $true
      
      Update-MgDirectoryOnPremiseSynchronization `
        -OnPremisesDirectorySynchronizationId $OnPremSync.Id `
        -Features $OnPremSync.Features
   

   • Then set the Entra password validity period for the domain:

      Update-MgDomain -DomainId "<domain name>" -PasswordValidityPeriodInDays <Int32> [-PasswordNotificationWindowInDays <Int32>]
   

   Important details:
   • Existing synchronized users do not have DisablePasswordExpiration removed immediately. It is removed on the next password hash sync after their next on-premises password change.
   • New synchronized users will not have PasswordPolicies set.
   • Update-MgUser and Update-MgDomain do not work on federated domains.
3. For account expiration specifically, since accountExpires is not synchronized, use a scheduled PowerShell script to disable expired users in on-prem AD. The documented recommendation is to disable users once they expire by using Set-ADUser. This addresses account expiration, but it does not change the fact that PHS authentication itself is cloud-based.

If the requirement is that cloud access must stop immediately when the on-prem password is expired or the account is locked, PTA is the better fit.

---

• Implement password hash synchronization with Microsoft Entra Connect Sync
• Build resilience in your hybrid architecture
• Microsoft Entra Connect user sign-in options
• Account Lockout using Microsoft Entra Connect - Microsoft Q&A
• Password Hash Sync - Change default password expiry - Microsoft Q&A