Troubleshooting password synchronization

This page will help you resolve the most common issues related to password synchronization in Microsoft Azure Active Directory (AD). Before you troubleshoot using the steps below, ensure that Azure AD Connect is updated to the latest version available.

Users are not able to log in to one or any Microsoft cloud service

Below are some scenarios in which this can happen, and their solutions:

• Cause: The User must change password at next logon setting is enabled.
  • Solution: To resolve this, navigate to the user account options in the Active Directory Users and Computers console, and deselect the checkbox next to User must change password at next logon. Alternatively, you can have the user change their on-premises AD password.
• Cause: The user changed their password through the Azure AD portal.
  • Solution: Have the user change their on-premises AD password.
• Cause: Some users are not synced to Azure AD by Azure AD Connect. This could be because of duplicate usernames or mail addresses.
  • Solution: This can be detected using the IdFix tool offered by Microsoft. Now, replace the detected duplicate attributes with unique values.

Passwords are not synced even though directory synchronization is running

Causes:

• The Synchronize now setting is not enabled.
• Password synchronization is enabled after directory synchronization was completed.
• The directory synchronization is yet to be completed.

Solution: Ensure that password synchronization is enabled and perform a full password sync.

Sync AD passwords efficiently with ADSelfService Plus

Azure AD Connect is responsible for synchronizing Azure AD and on-premises AD. Configuring and troubleshooting Azure AD Connect requires knowledge of various PowerShell commands and the corresponding parameter names. This can make password syncing a cumbersome task that is prone to multiple errors.

ADSelfService Plus is an integrated Active Directory self-service password management and single sign-on solution that can easily sync users' AD passwords across multiple platforms in real time, eliminating the need to track multiple passwords.

• Real-time password sync: Sync AD passwords across multiple applications, right after the password is changed or reset.
• Easy configuration: Only minimal information is required to set up password sync in ADSelfService Plus.
• Group and OU-based policies: Enable password sync for select users based on their groups or organizational units (OUs).
• Universal password policy: Enforce the same password policy across multiple platforms including Active Directory, Microsoft 365, Google Workspace (formerly G Suite), Salesforce, IBM iSeries, and Oracle Database. This way, you can ensure that no password is left weak enough to be successfully attacked.