r/entra • u/aswarman • 4d ago
Entra ID Password Reset
Last week everything was working great. Then school started and all went to hell. We are hybrid we were using Entra Connect to sync with one server on standby in staging mode. But monday password resets would not work at all. It would either timeout or say the password is not strong enough. 30 character random passwords would not work either. I switched our student ou to sync with the new Entra Cloud Sync and it did the same thing and made no difference. We dont have a password policy set on our AD controller except for it has to be 8 characters. Minimum password age is set to 0. I checked the service account to make sure its delegated to that ou. Any help would be appreciated.
2
u/aswarman 4d ago
When I set a password in the domain controller, it works and shows up in entra. And also, I know writeback works because when I set a password using MS graph without having the reset password set true it writes back the password just fine and works perfectly. It’s only when the user is prompted for a reset that it fails.
1
u/Fair_Helicopter_8531 4d ago
Does the sync agent's logs show the write backs for the resets? Understand it still works fine with MS graph but the reason I ask is it might help narrow it down.
If it doesn't show up then you can eliminate all steps post local ad sync.
Shouldn't have been showing failed since the graph portion worked, but doesn't hurt to check. Just in case it was updating in AD but when it tried to update Entra it failed (though at this point both password complexity checks (the ones in entra and the local ad ones should have been fulfilled by this point)
If it succeeded on the write but failed to send to Entra then that helps knock out a lot of the steps prior.
Also, what reason does the user audit logs give? Does it have anything like the category?
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-sspr-reporting
I apologize if these are things you already checked. Again, I am not a expert but I am kind of interested\invested in this now and just want to see if there is any way I can help.
1
u/aswarman 3d ago
If I set the password in AD it will sync up to entra. In entra it says it fails due to password strength not met.
1
u/screampuff 4d ago
Have you tried ruling anything out. Like unsync a user and see if they still have the issue doing AD only resets or Entra only resets on the cloud account?
1
1d ago
[removed] — view removed comment
1
u/laquain24 19h ago
And.... we just had another user affected. Will post updates when we figure out what's going on.
2
u/Fair_Helicopter_8531 4d ago
Does setting the password from a AD DC and then letting a sync run show in the logs of the user in Entra? Do the Audit logs show anything or offer any more info? Just wanted to ask in case it was something like the cloud sync agent having some issues so when it goes to update the password on password writeback it is failing or saying that it doesn't meet the complexity requirements (even if you only have the 8 character min character length) as it is timing out during the process. Not an entra expert (just recently migrated some of my env to hybrid) and we used Entra Connect Sync over the Cloud sync so your mileage may vary as I have not worked with the cloud sync agent yet, but might at least give more info. Hopefully someone else can offer you more specific info for your problem.