Unable to enable password writeback Azure AD Connector - Error Offboarding: AccessDenied, Message: User does not have service onboarding permissions

Question

Hey Team,

I have been struggling with an issue and have not been able to find anything with my google foo that relates to this issue.

I am unable to enabled password writeback within the Azure AD connector, the error that shows in the event log is...

TrackingId: 0a34fa1d-5e2b-4437-9ccc-5f70682e48cd, Error Offboarding: AccessDenied, Message: User does not have service onboarding permissions, Details:

I have followed the enable sspr tutorial to a tee (https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback?WT.mc_id=Portal-Microsoft_AAD_IAM#configuring-password-writeback), it just won't let me enable writeback in the AD Connect Tool.

I am the AD Administrator for my on-premise domain and the global cloud administrator of AAD. the account running AD Connect is a cloud global administrator (not synced from on-prem, as advised by Microsoft https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/unable-configure-pwd-writeback-error), I note my time was out by 3 mins but I have fixed that too.

I have googled high and low, but there are no references to this problem. I am hoping someone here may have a solution.

I appreciate any assistance that you can give.

Answer 1

Hey Team,

I thought I would update, as I was able to solve this by simply enabling Password Writeback via Powershell.

$ADconnector = (Get-ADSyncConnector | Where-Object {$_.Name -like "*AAD"}).Name
Set-ADSyncAADPasswordResetConfiguration -Connector $ADconnector -Enable:$True

I can confirm that my users can now reset passwords via sspr and they sync back to on-prem.

I hope that saves someone days of frustration :)

Ta,

Answer 2

Upvote. Worked for us too.