Office 365 Password Requirements

[FN-GM]

Hi,

 

With Office 365 how do the password requirements work with Synced Accounts please? Are they ignored when you have Synced AD accounts?

 

Thanks

Edited February 12, 2014 by FN-GM

[plexer]

I set my fine grained password policy to match the O365 requirement i.e 8 chars, upper & lower case and numbers.

 

Allthough Implement Password Synchronization says

 

When you enable password sync, the password complexity policies configured in the on-premises Active Directory override any complexity policies that may be defined in the cloud for synchronized users. This means any password that is valid in the customer's on-premises Active Directory environment can be used for accessing Azure AD services.

 

Ben

[FN-GM]

Thanks for that, the user can change the password in Office 365, so i should set it to the same as my AD anyway.

[FN-GM]

Hi @plexer we have setup dirsync with passwords. The AD passwords will only work in 365 once we have reset the passwords in AD. This says just tell the users to reset the passwords - How to troubleshoot password synchronization when using the Windows Azure Active Directory Sync tool

 

Did you have this? How did you get around this please?

[Cache]

If I get a password which has fallen out of sync (it normally happened after moving a user into a Synced OU from outside a Synced OU I think) I followed the steps in this (can't find the KB I pulled it from, but the steps are the same): How to: Force Password Synchronization between an onPremise Active Directory and Microsoft Online Services / Windows Azure AD - Knowledge eXchange

This suggests you can do it using Powershell however: DirSync/Windows Azure AD Password Sync Frequently Asked Questions - TechNet Articles - United States (English) - TechNet Wiki

[FN-GM]

Thanks @Cache that fixed it!

 

Do the passwords sync with DIRSYNC? or is there something else going on for password sync? As DIRSYNC is every 3 hours, it will take 3 hours for a user to get into 365 again after a password reset.

 

Thanks

[Cache]

Dirsync controls the password sync, but it monitors AD for password changes and uploads them as soon as they occur (hence resetting passwords works). So any password changes you should be ok with and it's always worked pretty reliably with us.

 

The only times I've had to force a full sync was when I was reorganising AD and taking users which didn't use to be synced and adding them to a new OU which was. Dirsync successfully created it but the password din't work until it had been changed.

 

The other little caveat I've found and not quite pinpointed exaclty, I don't think the password will work within Office 365 if the user hasn't logged on internally before. I'm not sure whether this is all related to the same thing, some little quirk or something wrong with the way ours works. People change passwords on first logon anyway so as a double check that always fixes things.

Edited February 12, 2014 by Cache

[FN-GM]

Cheers, thats all i need really.

 

Thanks for the password sync. I am just wondering why it didn't sync when i first synced all user accounts.

[plexer]

When you first sync a user account it doesn't know the password for the users, when a user resets their password it's also send to the password change notification service that dirsync installs and is then hashed and sent to the cloud.

 

Ben

[EduTech]

Hi,

 

Office 365 Password Requirements are in terms of length "8 characters minimum and 16 characters maximum" if you use Password Sync then your OnPremise Active Directory Policy overrides this so in theory you could actually have a very weak password if your AD policy on-premise allows that.

 

The passwords are sent to Office 365, The password is sent hashed and then the hash is then hashed again and then it is sent to Azure AD :-)

 

If you have any questions around this let me know, think the guys covered a lot above.

 

James.

[sonofsanta]

The other little caveat I've found and not quite pinpointed exaclty, I don't think the password will work within Office 365 if the user hasn't logged on internally before. I'm not sure whether this is all related to the same thing, some little quirk or something wrong with the way ours works. People change passwords on first logon anyway so as a double check that always fixes things.

 

This, and also if you force your users to reset their password after 90 days (or whatever) - when the password change comes up, it stops logging in via mail.office365.com until they have logged on a machine and hit the "you must change your password" error. This has recently been a pain in the wotsit for my missus on maternity leave, she logged in last night for the first time in ages and had >1000 emails to sort!

[fairm010]

FN-GM, do you have to set up AD Federation and all that stuff or is it as simple as installing DirSync?

[FN-GM]

FN-GM, do you have to set up AD Federation and all that stuff or is it as simple as installing DirSync?

 

At the moment I have got it all working with DirSync. Usernames and passwords in Office 365 are the same as AD. I am going to use ADFS but not just yet.

[FN-GM]

FN-GM, do you have to set up AD Federation and all that stuff or is it as simple as installing DirSync?

 

At the moment I have got it all working with DirSync. Usernames and passwords in Office 365 are the same as AD. I am going to use ADFS but not just yet.

[fairm010]

Cheers, i'll look into it now.