I am trying to enable users to update their password.

I have a Server 2016 with Active Directory and ADFS configured for SSO.
SSO works fine and Active Directory is synced with Azure AD.
We use Office 365 and new users are synced as planned.

I enabled the AD FS endpoint /adfs/portal/updatepassword as is asked in tutorials that I have read.
When I surf to https://www.example.com/adfs/portal/updatepassword I get "HTTP Error 503. The service is unavailable." Same for http.

I have enabled AD FS Tracing in the event viewer but I cannot find any entries to help me locate and fix the problem.

Also, when I click change password from Office 365, I get an error "You can't change your password here".

I don't know if these two are related or not, but I'm completely stuck. Any help would be greatly appreciated!

So just to be clear: I want users that are not working on domain joined computers, to be able to change their password from their Office 365 environment.

Edit: I get this error in AD FS Admin event log:

There was an error in enabling endpoints of Federation Service. Fix configuration errors using PowerShell cmdlets and restart the Federation Service. 

Additional Data 
Exception details: 
System.Net.HttpListenerException (0x80004005): Access is denied
   at System.Net.HttpListener.AddAllPrefixes()
   at System.Net.HttpListener.Start()
   at Microsoft.IdentityServer.WebHost.HttpListenerBase.Start(UInt32 contextPoolSize)
   at Microsoft.IdentityServer.Web.PassiveProtocolListener.Start()
   at Microsoft.IdentityServer.ServiceHost.STSService.OnStartInternal(Boolean requestAdditionalTime)

I have disabled the updatepassword endpoint and I still get this error when I restart the AD FS Service. So does this error somehow prevent the endpoint from being enabled/loaded? And where can I find the logs of the web server? I'm flying (crashing) blind here.


If the users in Azure AD are federated or password synced from on-premises, then you should enable Password WriteBack before they can change passwords from the Office 365 portal. Also note that the Password WriteBack feature requires Azure AD Premium subscription. More details about this can be found here.

Yes, it is also possible using the endpoint /adfs/portal/updatepassword/ to let your users change passwords. However, you should note that:

  1. If you are using ADFS 3.0 on Server 2012 R2, by default only on the workplace joined devices(device registered in AD) users can change passwords. You can install the hotfix KB3035025 to get rid of this.

  2. You should enable the updatepassword endpoint on proxy to make the users from external network have the ability to change passwords. More details about the detailed steps can be found here.

  • Thank you for confirming to me that the updatepassword endpoint is a separate option for doing this. Password Writeback is enabled, but I don't have Azure AD Premium yet. (I asked prices) So for now I would like to try the updatepassword endpoint. I use Server 2016 so the hotfix is not for me, and I already did "enable" and "enable on proxy" for the endpoint. Logging in from the external network works, so the adfs server is reachable. But even from inside the network, the /adfs/portal/updatepassword endpoint gives me a 503 Service Unavailable. I would love to find an error log somewhere. – Johan Claes Mar 29 '17 at 7:46
  • Did you remember to restart the ADFS service after enabling this endpoint? – Longfei Sun - MSFT Mar 29 '17 at 9:47
  • Absolutely, I've been at it for several days now, I have also restarted the server multiple times, for example: disable the endpoint, restart service, restart server, enable endpoint, restart service, restart server, and so on, you get the point. I'm looking for the web server logs (not IIS in adfs 3.0) since there are no error entries in the trace debug or other event logs of adfs. – Johan Claes Mar 29 '17 at 11:18
  • When i go to example.com/adfs/portal/updatepassword I get "HTTP Error 503" but no new entry in the event log. Not even info. – Johan Claes Mar 29 '17 at 11:20
  • In my server 2016 lab, I can access the portal and update passwords without issues. You can try to run the command: netsh http show urlacl on your ADFS server to check if the reserved url https://+:443/adfs/ is in the listening state. – Longfei Sun - MSFT Mar 30 '17 at 5:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.