Azure AD Connect Issues

[Michael]

Hi all,

 

I'm having a few 'snags' getting Azure AD Connect to work as I require. The latest version is installed on Windows Server 2016 and users are being synced correctly. For the time being, pupils have a static password and this works absolutely fine in AD and O365.

 

Staff however, I want them to be able to change their password from the default set. The AD side of things looks fine.

 

When a test Staff user first logs into O365, they're prompted to change their password, but then I receive a message 'Your organisation doesn't allow you to update your password on this site. Please update it using the method recommended by your organisation, or ask your admin if you need help.'

 

I have Password Writeback enabled and I've even explored the option of allowing users to reset their own passwords and still no go. I must be overlooking something really obvious!?

 

Some articles I've found online state the end user can only reset password within AD and not O365, but this cannot be right surely?

[Michael]

Right the latest is - If I set a static password to a user in AD, this syncs to Azure within 30 mins and then works as required. So does this mean for definite that users need to reset their passwords from Active Directory only?

[3s-gtech]

Hmmm - i was under the impression that password writeback worked with Azure AD Connect (without ADFS) if you choose the tickbox when installing. Not tested it here, but the guides suggest it works.

[DavetheITguy]

Make sure users can change their own password in AD. If you've denied that it won't work.

[Michael]

Make sure users can change their own password in AD. If you've denied that it won't work.

 

Yes they can - for example (by default) I create the user either manually or automated and prompt them to change their password. I was under the impression that could do this from O365 or AD first and that the changes replicate in both directions, but evidently they don't appear to do so.

 

I just receive the message 'Your organisation doesn't allow you to update your password on this site....' as I wrote above.

[Michael]

Some websites are stating this is an 'Azure AD Premium feature', but not sure what that actually means? I'm using Free Student/Faculty O365 licensing, whatever it's called these days.

[Michael]

Taken from here

 

Pricing and availability

 

Azure AD Password Reset is available in 3 tiers, depending on which subscription you have:

•Azure AD Free - cloud-only administrators can reset their own passwords

•Azure AD Basic or any Paid O365 Subscription - cloud-only users and cloud-only administrators can reset their own passwords

•Azure AD Premium - any user or administrator, including cloud-only, federated, or password synced users, can reset their own passwords (requires password writeback to be enabled)

 

At no point during Azure AD Connect does it mention that it's a Premium Feature...

[FoxHound]

I have hiot a very similar thing. I had enabled password writeback, but the password change was not being written back. Turns out writeback is a feature of AD premium only (not particularly highlighted anywhere. Just had a quote for it as £6.60 per FTE under EES per anum.

 

Have you checked that the user is allowed to change their password in Azure AD (look at the individual user). ?

[Michael]

Even if you change Azure AD policies so Staff can self-change passwords using a phone number, security questions or alternative e-mail, it makes no difference.

 

The cost isn't justifiable at all in my opinion.

[Michael]

Confirmed here also. A lot of Admins all complaining about the same issue. Unbelievable really!

[3s-gtech]

Bit of a pain, does it cause big issues for you or can it just be 'one of those things'.

[FoxHound]

I intend to get AD premium, soley because I need 2FA when used externally and its cheaper to get AD premium than just subscribe to MFA on its own.

 

But you are right, it doesn't mention it in AD connect at all. I went through an embarrasing process with the network team believing it to be a firewall issue, only to discover that its a premium feature.