Clarification needed on password expiration behavior for PHS synchronized users with CloudPasswordPolicyForPasswordSyncedUsersEnabled enabled

Dey, Dipronil 0 Reputation points
2026-07-10T15:11:17.0966667+00:00

We are using Microsoft Entra ID Password Hash Synchronization (PHS) in a hybrid identity environment.

Our current configuration:

  • Password Hash Sync: Enabled
  • cloudPasswordPolicyForPasswordSyncedUsersEnabled: true
  • Microsoft 365 Admin Center password expiration policy: Passwords are set to "Never expire"
  • Synchronized user attribute:
    • passwordPolicies = None
    • Cloud-only users also show:
      • passwordPolicies = None

I would like clarification on the expected password expiration behavior for synchronized users.

My understanding is that when cloudPasswordPolicyForPasswordSyncedUsersEnabled is set to true, synchronized users no longer receive the DisablePasswordExpiration setting and instead follow the Microsoft Entra ID password policy.

My questions are:

For a PHS synchronized user with:

  • cloudPasswordPolicyForPasswordSyncedUsersEnabled = true
    • passwordPolicies = None
      • Microsoft Entra password expiration policy set to "Never expire"
      Will the user's Microsoft 365/Entra password expire or never expire?
      1. Does cloudPasswordPolicyForPasswordSyncedUsersEnabled = true make synchronized users follow:
        • the on-premises Active Directory password expiration policy, or
          • the Microsoft Entra ID password expiration policy?
          1. If the on-premises AD password reaches its maximum password age and becomes expired, but the Entra ID password policy is set to "Never expire", what is the expected sign-in behavior for the synchronized user?
          2. How should we interpret passwordValidityPeriodInDays = null returned by Microsoft Graph for the domain? Does this indicate:
            • the default expiration period,
              • no expiration,
                • or another configuration state?

We are trying to confirm the authoritative password expiration source for synchronized users in a PHS environment.We are using Microsoft Entra ID Password Hash Synchronization (PHS) in a hybrid identity environment.

Our current configuration:

  • Password Hash Sync: Enabled
  • cloudPasswordPolicyForPasswordSyncedUsersEnabled: true
  • Microsoft 365 Admin Center password expiration policy: Passwords are set to "Never expire"
  • Synchronized user attribute:
    • passwordPolicies = None
    • Cloud-only users also show:
      • passwordPolicies = None

I would like clarification on the expected password expiration behavior for synchronized users.

My understanding is that when cloudPasswordPolicyForPasswordSyncedUsersEnabled is set to true, synchronized users no longer receive the DisablePasswordExpiration setting and instead follow the Microsoft Entra ID password policy.

My questions are:

For a PHS synchronized user with:

  • cloudPasswordPolicyForPasswordSyncedUsersEnabled = true
    • passwordPolicies = None
      • Microsoft Entra password expiration policy set to "Never expire"
      Will the user's Microsoft 365/Entra password expire or never expire?
      1. Does cloudPasswordPolicyForPasswordSyncedUsersEnabled = true make synchronized users follow:
        • the on-premises Active Directory password expiration policy, or
          • the Microsoft Entra ID password expiration policy?
          1. If the on-premises AD password reaches its maximum password age and becomes expired, but the Entra ID password policy is set to "Never expire", what is the expected sign-in behavior for the synchronized user?
  1. How should we interpret passwordValidityPeriodInDays = null returned by Microsoft Graph for the domain? Does this indicate:
    • the default expiration period,
      • no expiration,
        • or another configuration state?

We are trying to confirm the authoritative password expiration source for synchronized users in a PHS environment.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-07-10T15:12:56.6866667+00:00

    For the described PHS configuration, the behavior is as follows.

    1. Will the synchronized user’s Entra/M365 password expire?

    Given:

    • Password Hash Sync: Enabled
    • CloudPasswordPolicyForPasswordSyncedUsersEnabled = true
    • Domain password policy (via M365 admin center / Graph) effectively set to Never expire
    • User passwordPolicies = None

    The user’s Microsoft Entra / Microsoft 365 password will not expire.

    Reasoning from the docs:

    • When CloudPasswordPolicyForPasswordSyncedUsersEnabled is disabled (default), Entra Connect sets PasswordPolicies = "DisablePasswordExpiration" for synced users so that Entra ignores cloud password expiration.
    • When CloudPasswordPolicyForPasswordSyncedUsersEnabled is enabled, Entra stops setting DisablePasswordExpiration and instead applies the Entra password expiration policy for that domain/user.
    • If the Entra password policy for the domain is configured to “Never expire”, then even with CloudPasswordPolicyForPasswordSyncedUsersEnabled = true, the effective result is still no expiration for those users.

    From the password policy FAQ:

    • For synced users with PHS, password expiration values are stored separately in on-prem AD DS and Entra ID.
    • “When signing in to the Azure portal or Microsoft 365, the Microsoft Entra ID password expiration policy applies.”
    • “By default, for password hash–synchronized users, the Microsoft Entra ID password expiration is set to never expire.”

    So in the current configuration, the cloud password does not expire.

    2. What does CloudPasswordPolicyForPasswordSyncedUsersEnabled = true actually make synced users follow?

    CloudPasswordPolicyForPasswordSyncedUsersEnabled = true makes PHS-synchronized users follow the Microsoft Entra ID password expiration policy, not the on-premises AD DS expiration policy, when they authenticate in the cloud.

    From the docs:

    • “If you don't want users to sign in to Microsoft Entra ID with an expired on-premises password, enable the CloudPasswordPolicyForPasswordSyncedUsersEnabled option so that Microsoft Entra ID doesn't treat passwords as non-expiring.”
    • And: “If the policy in your on-premises Active Directory is different, you can update the Microsoft Entra password policy to match by using the Update-MgDomain -PasswordValidityPeriodInDays command. Microsoft Entra supports a separate password expiration policy per registered domain.”

    This explicitly states that the Entra password policy (per domain) is what is enforced when this feature is enabled; you then align that policy to your on-prem policy if desired.

    3. Scenario: on-prem AD password expired, Entra policy = Never expire

    Scenario:

    • On-prem AD DS maximum password age reached → password is expired on-prem.
    • PHS is enabled.
    • CloudPasswordPolicyForPasswordSyncedUsersEnabled = true.
    • Entra password policy for the domain is effectively Never expire.

    Behavior:

    • When the user signs in to on-prem (for example, domain-joined Windows logon), on-prem AD DS password expiration policy applies and the user is prompted to change the password.
    • When the user signs in to Entra / Microsoft 365, the Entra password expiration policy applies. Because the Entra policy is “Never expire”, Entra will still allow sign-in with the last synchronized password and will not prompt for password change based on expiration.

    The docs state:

    • “Because password information exists in both environments, the applied expiration policy depends on where the user signs in (where authentication occurs).”
    • “When signing in to the Azure portal or Microsoft 365, the Microsoft Entra ID password expiration policy applies.”
    • “By default, for password hash–synchronized users, the Microsoft Entra ID password expiration is set to never expire. As a result, even after the on-premises AD DS password expires, users can still sign in to Microsoft Entra ID using the expired password.”

    Enabling CloudPasswordPolicyForPasswordSyncedUsersEnabled changes how Entra treats expiration, but it still uses the Entra policy. If that policy is “Never expire”, the cloud sign-in remains allowed.

    4. How to interpret passwordValidityPeriodInDays = null

    passwordValidityPeriodInDays is a domain-level Entra password expiration setting, configurable via Update-MgDomain -PasswordValidityPeriodInDays.

    From the PHS documentation:

    • “If the policy in your on-premises Active Directory is different, you can update the Microsoft Entra password policy to match by using the following PowerShell command. Microsoft Entra supports a separate password expiration policy per registered domain. powershell Update-MgDomain -DomainId "<domain name>" -PasswordValidityPeriodInDays <Int32> [-PasswordNotificationWindowInDays <Int32>]

    The context does not explicitly define the semantics of null, but combined with the password policy FAQ and Q&A examples:

    • Newer tenants generally have passwords effectively set to never expire by default.
    • The domain-level password policy can be set explicitly to a number of days; if not set, Entra uses its default behavior.

    In practice, passwordValidityPeriodInDays = null indicates that no explicit custom validity period has been set on that domain, and the tenant/domain is using the default Entra password expiration behavior. For tenants created after 2021, that default is effectively no expiration unless overridden.

    To change this, set a concrete value (for example, 90 or 120) on each registered domain using Update-MgDomain -PasswordValidityPeriodInDays (or the equivalent legacy Set-MsolPasswordPolicy in older guidance). Once set, that value becomes the authoritative Entra password expiration period for users in that domain when CloudPasswordPolicyForPasswordSyncedUsersEnabled = true.

    5. Authoritative password expiration source for PHS users

    For PHS-synchronized users:

    • Where authentication occurs determines which policy is authoritative:
      • On-prem sign-in → on-prem AD DS password expiration policy.
      • Cloud sign-in (Entra / Microsoft 365) → Entra password expiration policy.
    • CloudPasswordPolicyForPasswordSyncedUsersEnabled = true ensures that, for cloud sign-ins, Entra enforces its own password expiration policy (per domain) instead of treating synced passwords as never-expiring.

    To align behavior, configure:

    1. On-prem AD DS password policy (Default Domain Policy → Account Policies → Password Policy).
    2. Entra domain password policy (PasswordValidityPeriodInDays per domain) to match the same number of days.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.