Convert-EntraFederatedUser

Reference

Module:: Microsoft.Graph.Entra

Updates a user in a domain that was recently converted from single sign-on (also known as identity federation) to standard authentication type.

Syntax

Convert-EntraFederatedUser
       -UserPrincipalName <String>
       [-NewPassword <String>]
       [<CommonParameters>]

Description

The Convert-EntraFederatedUser cmdlet is used to update a user in a domain that was recently converted from single sign-on (also known as identity federation) to standard authentication type. A new password must be provided for the user.

This process writes the new password to Microsoft Entra ID and, if configured with password writeback, pushes it to on-premises Active Directory. The admin can provide a new password or let the system generate one. The user will be prompted to change their password at their next sign-in.

For delegated scenarios, the administrator needs at least the Authentication Administrator or Privileged Authentication Administrator Microsoft Entra role.

Admins with User Administrator, Helpdesk Administrator, or Password Administrator roles can also reset passwords for non-admin users and a limited set of admin roles.

Examples

EXAMPLE 1: Update a user in a domain

Connect-Entra -Scopes 'UserAuthenticationMethod.ReadWrite.All'
Convert-EntraFederatedUser -UserPrincipalName 'pattifuller@contoso.com'

This command updates a user in a domain.

Parameters

-NewPassword

The new password of the user.

The new password is required for tenants with hybrid password scenarios. If omitted for a cloud-only password, the system generates a password. This password is a Unicode string with no other encoding. It is validated against the tenant's banned password system before acceptance and must meet the tenant's cloud and/or on-premises password requirements.

Type:	System.String
Position:	2
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-UserPrincipalName

The Microsoft Entra ID UserID for the user to convert.

Type:	System.String
Position:	1
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

Notes

For more information, see resetPassword.

Share via