Syncing 'User must change password at next logon' to Azure

[CyBeRkId2002]

Trying to streamline our onboarding process and aiming to have students be able to logon for the first-time either onsite (AD) or online (Azure AD). At present if the 'User must change password at next logon' box is ticked, the password doesn't sync.

 

I am fairly sure all we need to do is run "Set-ADSyncAADCompanyFeature -ForcePasswordChangeOnLogOn $true" on the server. Has anyone done this? Any drawbacks? Our password writeback is working so looks fairly straightforward, just the ForcePasswordChangeOnLogOn looks quite scary, and just want to check this doesn't change any attributes within AD, but simply propagates these settings to the cloud.

[Steve21]

I’ve turned this on over summer for our side and read in a few places that it doesn’t propagate old “ticks” after you enable it unless you do a full sync rather than delta

 

So just one to keep an eye on as if you already have users ticked (for example year 7) they wouldn’t be able to use with that full sync

 

Apart from that no downside noticed “yet”

 

Steve

[CyBeRkId2002]

Just to update - implemented this yesterday. Works perfectly and definitely streamlines our onboarding process. Would recommend to anyone who has a hybrid setup.