Password expiration policies in Azure AD

by

Check the expiration policy for a password

  1. Open a PowerShell prompt and connect to your Azure AD tenant using a Global Administrator or User Administrator account.
  3. Run one of the following commands for either an individual user or for all users:
    • To see if a single user’s password is set to never expire, run the following cmdlet.
    • Replace <user ID> with the user ID of the user you want to check, such as driley@contoso.onmicrosoft.com:

Get-AzureADUser -ObjectId | Select-Object @{N=”PasswordNeverExpires”;E={$_.PasswordPolicies -contains “DisablePasswordExpiration”}}

  • To see the Password never expires setting for all users, run the following cmdlet:

Get-AzureADUser -All $true | Select-Object UserPrincipalName, @{N=”PasswordNeverExpires”;E={$_.PasswordPolicies -contains “DisablePasswordExpiration”}}

Set a password to expire

  1. Open a PowerShell prompt and connect to your Azure AD tenant using a Global Administrator or User Administrator account.
  3. Run one of the following commands for either an individual user or for all users:
    • To set the password of one user so that the password expires, run the following cmdlet.
    • Replace <user ID> with the user ID of the user you want to check, such as driley@contoso.onmicrosoft.com

Get-AzureADUser -ObjectId | Select-Object @{N=”PasswordNeverExpires”;E={$_.PasswordPolicies -contains “DisablePasswordExpiration”}}

  • To see the Password never expires setting for all users, run the following cmdlet:

Get-AzureADUser -All $true | Select-Object UserPrincipalName, @{N=”PasswordNeverExpires”;E={$_.PasswordPolicies -contains “DisablePasswordExpiration”}}

Set a password to expire

  1. Open a PowerShell prompt and connect to your Azure AD tenant using a Global Administrator or User Administrator account.
  3. Run one of the following commands for either an individual user or for all users:
    • To set the password of one user so that the password expires, run the following cmdlet. Replace <user ID> with the user ID of the user you want to check, such as driley@contoso.onmicrosoft.com

Set-AzureADUser -ObjectId -PasswordPolicies None

  • To set the passwords of all users in the organization so that they expire, use the following cmdlet:

Get-AzureADUser -All $true | Set-AzureADUser -PasswordPolicies None

Set a password to never expire

  1. Open a PowerShell prompt and connect to your Azure AD tenant using a Global Administrator or User Administrator account.
  3. Run one of the following commands for either an individual user or for all users:
    • To set the password of one user to never expire, run the following cmdlet. Replace <user ID> with the user ID of the user you want to check, such as driley@contoso.onmicrosoft.com

Set-AzureADUser -ObjectId -PasswordPolicies DisablePasswordExpiration

  • To set the passwords of all the users in an organization to never expire, run the following cmdlet:

Get-AzureADUser -All $true | Set-AzureADUser -PasswordPolicies DisablePasswordExpiration

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy

Leave a Comment