[Office 365] DirSync users and self service password reset

[CraigM]

Hi everyone,

 

Probably a basic question, but something I can't seem to really find an answer for. Maybe someone here can give me a definitive answer.

 

We've got Office 365 working for years now, users are synced via DirSync from on premises AD. I don't have password writeback enabled as I don't have Azure Premium AD licenses. Since our country went on lockdown, I've had some users try to reset their passwords via the links on the MS login screen. Self Service Password reset is not enabled at present in any case.

 

I was just wondering what would happen if I enabled it? Let's say Joe Soap resets his password as he can't remember what it was. Now Office 365 has a new password in it. But the next time the DirSync tool runs and uploads the on premises password hashes to O365, wouldn't it just overwrite whatever he chose as a new password with whatever his old on premises password was? That's the answer I can't seem to find out.

 

Logically my mind says this is what would happen, if O365 even let a synced user change their password without writeback enabled. In my mind, the on premises AD is authorative and will override anything set by the user via O365?

 

Many thanks and stay safe out there!

[Norphy]

If you have an Azure AD P1 or above license and have password write back and SSPR enabled and someone changes their Password inside Office 365, the changed password is written back to the local AD. The next time an AAD sync is run, the old password isn’t synced back because Azure AD connect has written a new one to AD.

 

If password writeback isn’t enabled, this plain won’t work as Azure AD will see that the account is an AD managed one and won’t do anything if the user tries to change their password. It will tell them that the feature isn’t enabled for them.

 

 

Just a note, DirSync is loooong deprecated, you should be using Azure AD Connect to sync your AD users to AAD if you’re not already.

Edited April 14, 2020 by Norphy

[CraigM]

If you have an Azure AD P1 or above license and have password write back and SSPR enabled and someone changes their Password inside Office 365, the changed password is written back to the local AD. The next time an AAD sync is run, the old password isn’t synced back because Azure AD connect has written a new one to AD.

 

If password writeback isn’t enabled, this plain won’t work as Azure AD will see that the account is an AD managed one and won’t do anything if the user tries to change their password. It will tell them that the feature isn’t enabled for them.

 

 

Just a note, DirSync is loooong deprecated, you should be using Azure AD Connect to sync your AD users to AAD if you’re not already.

 

Thanks, this does make complete sense to me and confirms my hunch. Apologies about the name, I am using Azure AD Connect! I just so rarely need to touch the thing that I completely forgot the modern name! It's actually been a pretty set it and forget it kind of piece of software for me, which makes for a really nice change!