We're getting AD setup in our environment, so I have most of my users imported with requirements that they must change password at next logon.

We're using Azure Active Directory (Premium).

I want the users to use the Azure portal to set their initial password and password reset information.

However, the portal won't let anyone login who hasn't already changed their password.

I'm guessing it is looking at the "pwdLastSet" attribute, but there doesn't seem to be a way to set that via PowerShell. That attribute seems to be the only one that is really different from someone who is able to login successfully.

Maybe there is an MSOL attribute I need to set?

Am I wrong? Anyone been able to do this?


PwdLastSet is a restricted attribute that cannot be set manually or individually. Only domain controllers can update that attribute when the user changes their password.
Sounds like MS designed ADSync to work this way for accounts with the "must change" flag set.


When you reset the user's password, make sure that the User must change password at next logon check box isn't selected.

  • I like you're first version better, dubbing it a "feature". Good find on the KB - I had been coming up empty on that little detail. – willWorkForCookies Jan 27 '16 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.