Clarification needed on password expiration behavior for PHS synchronized users with CloudPasswordPolicyForPasswordSyncedUsersEnabled enabled

For the described PHS configuration, the behavior is as follows.

1. Will the synchronized user’s Entra/M365 password expire?

Given:

• Password Hash Sync: Enabled
• CloudPasswordPolicyForPasswordSyncedUsersEnabled = true
• Domain password policy (via M365 admin center / Graph) effectively set to Never expire
• User passwordPolicies = None

The user’s Microsoft Entra / Microsoft 365 password will not expire.

Reasoning from the docs:

• When CloudPasswordPolicyForPasswordSyncedUsersEnabled is disabled (default), Entra Connect sets PasswordPolicies = "DisablePasswordExpiration" for synced users so that Entra ignores cloud password expiration.
• When CloudPasswordPolicyForPasswordSyncedUsersEnabled is enabled, Entra stops setting DisablePasswordExpiration and instead applies the Entra password expiration policy for that domain/user.
• If the Entra password policy for the domain is configured to “Never expire”, then even with CloudPasswordPolicyForPasswordSyncedUsersEnabled = true, the effective result is still no expiration for those users.

From the password policy FAQ:

• For synced users with PHS, password expiration values are stored separately in on-prem AD DS and Entra ID.
• “When signing in to the Azure portal or Microsoft 365, the Microsoft Entra ID password expiration policy applies.”
• “By default, for password hash–synchronized users, the Microsoft Entra ID password expiration is set to never expire.”

So in the current configuration, the cloud password does not expire.

2. What does CloudPasswordPolicyForPasswordSyncedUsersEnabled = true actually make synced users follow?

CloudPasswordPolicyForPasswordSyncedUsersEnabled = true makes PHS-synchronized users follow the Microsoft Entra ID password expiration policy, not the on-premises AD DS expiration policy, when they authenticate in the cloud.

From the docs:

• “If you don't want users to sign in to Microsoft Entra ID with an expired on-premises password, enable the CloudPasswordPolicyForPasswordSyncedUsersEnabled option so that Microsoft Entra ID doesn't treat passwords as non-expiring.”
• And: “If the policy in your on-premises Active Directory is different, you can update the Microsoft Entra password policy to match by using the Update-MgDomain -PasswordValidityPeriodInDays command. Microsoft Entra supports a separate password expiration policy per registered domain.”

This explicitly states that the Entra password policy (per domain) is what is enforced when this feature is enabled; you then align that policy to your on-prem policy if desired.

3. Scenario: on-prem AD password expired, Entra policy = Never expire

Scenario:

• On-prem AD DS maximum password age reached → password is expired on-prem.
• PHS is enabled.
• CloudPasswordPolicyForPasswordSyncedUsersEnabled = true.
• Entra password policy for the domain is effectively Never expire.

Behavior:

• When the user signs in to on-prem (for example, domain-joined Windows logon), on-prem AD DS password expiration policy applies and the user is prompted to change the password.
• When the user signs in to Entra / Microsoft 365, the Entra password expiration policy applies. Because the Entra policy is “Never expire”, Entra will still allow sign-in with the last synchronized password and will not prompt for password change based on expiration.

The docs state:

• “Because password information exists in both environments, the applied expiration policy depends on where the user signs in (where authentication occurs).”
• “When signing in to the Azure portal or Microsoft 365, the Microsoft Entra ID password expiration policy applies.”
• “By default, for password hash–synchronized users, the Microsoft Entra ID password expiration is set to never expire. As a result, even after the on-premises AD DS password expires, users can still sign in to Microsoft Entra ID using the expired password.”

Enabling CloudPasswordPolicyForPasswordSyncedUsersEnabled changes how Entra treats expiration, but it still uses the Entra policy. If that policy is “Never expire”, the cloud sign-in remains allowed.

4. How to interpret passwordValidityPeriodInDays = null

passwordValidityPeriodInDays is a domain-level Entra password expiration setting, configurable via Update-MgDomain -PasswordValidityPeriodInDays.

From the PHS documentation:

• “If the policy in your on-premises Active Directory is different, you can update the Microsoft Entra password policy to match by using the following PowerShell command. Microsoft Entra supports a separate password expiration policy per registered domain. powershell Update-MgDomain -DomainId "<domain name>" -PasswordValidityPeriodInDays <Int32> [-PasswordNotificationWindowInDays <Int32>]

The context does not explicitly define the semantics of null, but combined with the password policy FAQ and Q&A examples:

• Newer tenants generally have passwords effectively set to never expire by default.
• The domain-level password policy can be set explicitly to a number of days; if not set, Entra uses its default behavior.

In practice, passwordValidityPeriodInDays = null indicates that no explicit custom validity period has been set on that domain, and the tenant/domain is using the default Entra password expiration behavior. For tenants created after 2021, that default is effectively no expiration unless overridden.

To change this, set a concrete value (for example, 90 or 120) on each registered domain using Update-MgDomain -PasswordValidityPeriodInDays (or the equivalent legacy Set-MsolPasswordPolicy in older guidance). Once set, that value becomes the authoritative Entra password expiration period for users in that domain when CloudPasswordPolicyForPasswordSyncedUsersEnabled = true.

5. Authoritative password expiration source for PHS users

For PHS-synchronized users:

• Where authentication occurs determines which policy is authoritative:
  • On-prem sign-in → on-prem AD DS password expiration policy.
  • Cloud sign-in (Entra / Microsoft 365) → Entra password expiration policy.
• CloudPasswordPolicyForPasswordSyncedUsersEnabled = true ensures that, for cloud sign-ins, Entra enforces its own password expiration policy (per domain) instead of treating synced passwords as never-expiring.

To align behavior, configure:

1. On-prem AD DS password policy (Default Domain Policy → Account Policies → Password Policy).
2. Entra domain password policy (PasswordValidityPeriodInDays per domain) to match the same number of days.

References:

• Implement password hash synchronization with Microsoft Entra Connect Sync
• Password policy overview and frequently asked questions
• Password policies and account restrictions in Microsoft Entra ID
• Password Hash Sync - Change default password expiry - Microsoft Q&A
• Entra ID user default password expiration policy - Microsoft Q&A
• Increase Azure AD password policy and On-premises AD password expiry policy of 90 days to 365 days - Microsoft Q&A
• Disable Microsoft Entra Connect now that we are not hybrid - Microsoft Q&A
• Password restrictions - Microsoft Entra External ID - Microsoft Q&A