Password Synch - Azure AD

[SimonInOz]

Hi,

 

We have Azure AD Connect, it all works fine basically, apart from two things:

 

One

 

When a user password is changed, we then have to direct them to change it in a load of areas on the W10 PC (pretty much latest updates):

 

Onenote, Onedrive, Email (plus check the box to retain the password), etc, etc

 

A basic question, is all of this not able to be automated? What is the point of Credential manager, if you cannot reuse a credential that has been changed?

 

Surely there is a better way to do this, and my personal thanks to anyone that can solve this for me. I have googled for some time, never found anything that would help so far.

 

Perhaps my searching is faulty, or it is just not possible, which would be amazing in its own right.

 

Two

 

How do you (correctly) setup a reverse pw sync between Azure and AD, so that a user can use the online password change feature? I need this stepped out, or a link to a process if possible. I am sure there was something to do with PKI last time I looked.

 

Well, any takers here?

 

Cheers all.

[aicrd]

To allow users to change passwords online you need to setup AzureAD Password Writeback: https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback

 

You'll need an Azure AD P1 licence for this.

[mavhc]

Desktop non UWP versions of Outlook, Onedrive and Onenote? Office 365 versions or older?

 

Are you using Seamless SSO?

[SimonInOz]

Office365, and desktop versions of Onenote, Outlook, Onedrive. Non UWP.

 

Tell me more about seamless SSO!

[HPlum78]

@mavhc is correct and below is a link for a starter for 10:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso

 

you don't need password write back you will need password hash sync.

[mavhc]

Step 1: use azure ad connect to sync password hashes to Azure, now your users have the same password in AD and Azure.

 

Step 2: turn on Seamless SSO, now if you log in while on the domain, at work, Azure and your DC talk and auto log you in.