Office 365 - Unwanted password prompt/reset with AD-synced accounts?

[pete]

Circumstances:

 

Local AD > Azure AD Connect > Office 365.

Password sync enabled, password writeback not enabled.

 

Affected users (pupils) not getting "hey change your password" prompts when logging into school network.

Affected users are getting a "you need to change your password" prompt in Office 365.

 

Using an unaffected test account, I can force a password reset in Office 365 for an AD-synced user. Said account has the password changed in Office 365, but not in Local AD (no write-back).

 

I was expecting it to say "you can't do that, it's an AD-synced account without writeback" when I attempted to reset the password in Office 365 Admin center. Instead it lets me reset the user password for Office 365, my AD-synced user has to change their password and then they're (apparently) scuppered because the *real* password from AD isn't then synced back to Azure/Office 365. The local AD password is unchanged (writeback disabled).

 

Has this behaviour changed recently? I'm expecting local AD to be treated as the single source of truth and Azure to reject password changes not initiated by Azure AD Connect, but this doesn't seem to be the case.

 

Looking in the sync logs, I can see things appear to be going across fine.

Edited March 10, 2016 by pete

[pete]

If I reset the password of the test user back to what it was in local AD Users and Computers, it then pushes the "correct" password back to Azure.

 

So it's fixable, I just wasn't expecting it to allow me to change it in the first place from within Office 365.

Edited March 10, 2016 by pete

[Boredguy]

We had the same issue yesterday with a couple of students, and I know a colleague at another school had the same on Wednesday.

 

We reset the users password in AD and it then let them log in normally after a minute or two.