--- title: "Keep in Sync with Microsoft Azure AD Sync Password Writeback" description: "Discover how to synchronize your Active Directory and Microsoft Azure AD passwords with the password writeback capability!" canonical: "https://adamtheautomator.com/password-writeback/" --- # Keep in Sync with Microsoft Azure AD Sync Password Writeback > Discover how to synchronize your Active Directory and Microsoft Azure AD passwords with the password writeback capability! Source: https://adamtheautomator.com/password-writeback/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Keep in Sync with Microsoft Azure AD Sync Password Writeback](https://adamtheautomator.com/wp-content/uploads/2022/07/Keep-in-Sync-with-Microsoft-Azure-AD-Sync-Password-Writeback.jpg) # Keep in Sync with Microsoft Azure AD Sync Password Writeback [![](https://secure.gravatar.com/avatar/9a14f10ff1b1ec7d790d34f5b559e4d3de2d31b172e6ef266dfd8b479174d97b?s=192&d=mm&r=g)June Castillote](https://adamtheautomator.com/author/june/)3 August 20227 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[Microsoft Azure](/tag/microsoft-azure/) Table of Contents * [Prerequisites](#prerequisites) * [Checking Password Writeback Support](#checking-password-writeback-support) * [Finding the Azure AD Connect On-Premises Directory Account](#finding-the-azure-ad-connect-on-premises-directory-account) * [Configuring Password Writeback Permissions](#configuring-password-writeback-permissions) * [Enabling Password Writeback in Azure AD Connect](#enabling-password-writeback-in-azure-ad-connect) * [Enabling Password Writeback in Azure Active Directory](#enabling-password-writeback-in-azure-active-directory) * [Testing Password Writeback](#testing-password-writeback) * [Password Change](#password-change) * [Password Reset](#password-reset) * [Conclusion](#conclusion) The on-premises infrastructure typically remains when your organization’s directory service moves to the cloud, particularly Azure Active Directory. This co-existence is known as a hybrid setup and can often confuse end users because some tasks they need to do on-premises while some are in the cloud. One example is resetting or changing passwords. Some organizations require password change in their on-premises AD. If the users attempt to reset their passwords in Azure AD, they get an error, which leads to service desk calls and a decline in user experience. > Remove Exchange on-premises without compromising ease of management. [Use EasyEntra](https://easyentra.com/easyentra-ad-manager-freemium-edition/?utm_source=adam&utm_medium=paid&utm_campaign=easyentra&utm_content=freemiumarticle) instead of AD Users & Computers – Completely Free! What’s the right move? You should enable password writeback in Azure AD and your hybrid Active Directory infrastructure. Stay tuned; this tutorial teaches you how to enable password writeback step by step. > _Scan Your AD for 930+ Million Compromised Passwords. [Download Specops Password Auditor](https://specopssoft.com/product/specops-password-auditor/?utm_source=ata&utm_medium=referral&utm_campaign=na_2023_ata&utm_content=mention), a FREE read only tool that identifies password-related vulnerabilities._ ## Prerequisites This tutorial will be a hands-on demonstration. If you’d like to follow along, be sure you have the following: * An Azure AD tenant – Register a [free account](https://azure.microsoft.com/en-us/free/) if you don’t have one. * An admin account with a Global Administrator or [Hybrid Identity Administrator](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#hybrid-identity-administrator) role in Azure AD. * An on-premises Active Directory environment already configured with the latest Azure AD Connect – This tutorial uses a Windows Server 2019 Datacenter with Azure AD Connect 2.1.15.0. Related:[How To Connect Azure AD to Office 365 with Azure AD Connect](https://adamtheautomator.com/connect-azure-ad-to-office-365/) * The Self-Service Password Reset feature is already enabled in your Azure AD tenant. Related:[Self-Service Password Resets for Office 365 \[Complete Guide\]](https://adamtheautomator.com/self-service-password-reset-office-365/) * (Optional) The [Azure AD PowerShell module](https://learn.microsoft.com/en-us/microsoft-365/enterprise/connect-to-microsoft-365-powershell?view=o365-worldwide#connect-with-the-azure-active-directory-powershell-for-graph-module) is installed on your Windows Server or management computer. ## Checking Password Writeback Support Before enabling password writeback, you must ensure that all the necessary conditions are met. Not all Azure AD tenants support password writeback to on-premises AD. Follow the succeeding section to check and confirm password writeback eligibility and support. The primary condition to enable password writeback is the Azure AD Premium license. To check whether you have an Azure AD P1 or P2 license: 1\. Open your favorite web browser, and log in to the [Azure Active Directory admin center](https://aad.portal.azure.com/). 2\. Next, click the Azure Active Directory → Overview blade. You will see Azure AD Premium P1 or Azure AD Premium P2, similar to the screenshot below. ![Checking for Azure AD Premium License from the AAD admin center](https://adamtheautomator.com/wp-content/uploads/2022/07/image-343.png) Checking for Azure AD Premium License from the AAD admin center Related:[Azure AD Premium P1 vs P2: Which One to Choose?](https://adamtheautomator.com/azure-ad-premium-p1-vs-p2/) 3\. Alternatively, open PowerShell as admin and run the [Connect-AzureAD](https://learn.microsoft.com/en-us/powershell/module/azuread/connect-azuread?view=azureadps-2.0) command below to connect to the Azure Active Directory first. ```powershell Connect-AzureAD ``` Related:[Discover How to Run PowerShell as Administrator](https://adamtheautomator.com/powershell-run-as-administrator/) 4\. Now, run either of the following commands to list your tenant’s Azure AD Premium license. ```powershell (Get-AzureADSubscribedSku).ServicePlans | Where-Object {$_.ServicePlanName -like "AAD_PREMIUM*"} (Get-AzureADTenantDetail).AssignedPlans | Where-Object {$_.Service -eq 'AADPremiumService'} ``` The table below shows the license information about the Azure AD Premium.
Service Plan IDLicense NameGet-AzureADSubscribedSkuGet-AzureADTenantDetail
41781fb2-bc02-4b7c-bd55-b576c07bb09dAzure AD Premium P1AAD_PREMIUMAADPremiumService
eec0eb4f-6444-4f95-aba0-50c24d67f998Azure AD Premium P1AAD_PREMIUM_P2AADPremiumService
The screenshot below confirms that this tenant has an Azure AD Premium P2 license. ![Checking for Azure AD Premium License from the AAD PowerShell](https://adamtheautomator.com/wp-content/uploads/2022/07/image-344.png) Checking for Azure AD Premium License from the AAD PowerShell ## Finding the Azure AD Connect On-Premises Directory Account When you installed and configured Azure AD Connect, the installation process automatically created a forest login account. This account must have specific permissions for the password writeback to work properly. If you don’t know the current Azure AD Connect domain login account: Open [PowerShell as admin](https://adamtheautomator.com/powershell-run-as-administrator/), and run the below commands to perform the following: * IImport ([Import-Module](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module?view=powershell-7.2)) the [AdSyncConfig](https://www.powershellgallery.com/packages/AdSyncConfig/1.2) module. This module is included in Azure AD Connect, located on _C:\\Program Files\\Microsoft Azure Active Directory Connect\\AdSyncConfig\\AdSyncConfig.psm1_. * Get the Azure AD Connector account name ([Get-ADSyncADConnectorAccount](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/reference-connect-adsyncconfig)). ```powershell Import-Module 'C:\\Program Files\\Microsoft Azure Active Directory Connect\\AdSyncConfig\\AdSyncConfig.psm1' Get-ADSyncADConnectorAccount ``` You’ll get the following result, showing the **ADConnectorAccountName** property contains the Azure AD Connector account name. ![Getting the Azure AD Connector account name](https://adamtheautomator.com/wp-content/uploads/2022/07/image-345.png) Getting the Azure AD Connector account name ## Configuring Password Writeback Permissions Azure AD Connector account must have the following permissions to the on-premises Active Directory domain. * _Reset password_ * _Write lockoutTime_ * _Write pwdLastSet_ * _Unexpire Password_ on each domain root in the forest. The good news is that you don’t need to set these permissions manually. The AdSyncConfig module includes a cmdlet called [Set-ADSyncPasswordWritebackPermissions](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/reference-connect-adsyncconfig#set-adsyncpasswordwritebackpermissions) that conveniently sets all the necessary permissions. To set the password writeback permissions, run the below command in PowerShell. Ensure to replace the `ADConnectorAccountName` and `ADConnectorAccountDomain` values with yours. ```powershell Set-ADSyncPasswordWritebackPermissions ` -ADConnectorAccountName MSOL_27c8dae74e08 ` -ADConnectorAccountDomain LAZYEXCHANGEADMIN.CYOU ` -Confirm:$false ``` Wait for the command to finish quickly, and you’ll get a confirmation message, as shown below. ![Setting the Password Writeback Permissions](https://adamtheautomator.com/wp-content/uploads/2022/07/image-346.png) Setting the Password Writeback Permissions ## Enabling Password Writeback in Azure AD Connect Now that you’ve confirmed your Azure AD tenant’s password writeback eligibility and configured password writeback permissions. But is that it? Well, not close enough. The next step is enabling password writeback in Azure AD Connect. 1\. Open Azure AD Connect on your server. ![Opening Azure AD Connect](https://adamtheautomator.com/wp-content/uploads/2022/07/image-347.png) Opening Azure AD Connect 2, On the Welcome to Azure AD Connect page, click Configure. ![Skipping past the welcome page](https://adamtheautomator.com/wp-content/uploads/2022/07/image-348.png) Skipping past the welcome page 3\. On the Additional tasks page, click Customize synchronization options → Next. ![Choosing to customize synchronization](https://adamtheautomator.com/wp-content/uploads/2022/07/image-349.png) Choosing to customize synchronization 4\. Now, on the Connect to Azure AD page, type your global administrator or hybrid identity administrator credentials and click Next. ![Providing your Azure AD credentials](https://adamtheautomator.com/wp-content/uploads/2022/07/image-350.png) Providing your Azure AD credentials 5\. Don’t change anything on the Connect your directories page and click Next. ![Keeping On-Premises directory information intact](https://adamtheautomator.com/wp-content/uploads/2022/07/image-351.png) Keeping On-Premises directory information intact 6\. Keep the defaults in the Domain and OU Filtering page to sync with all domains and OUs, and click Next. ![Keeping domain and OU filtering settings on default](https://adamtheautomator.com/wp-content/uploads/2022/07/image-352.png) Keeping domain and OU filtering settings on default 7\. On the Optional features page, tick the Password writeback feature since you’re enabling the password writeback, and click Next. ![Enabling the password writeback feature](https://adamtheautomator.com/wp-content/uploads/2022/07/image-353.png) Enabling the password writeback feature 8\. Leave the Start synchronization process box checked, and click Configure to start the synchronization as soon as the configuration completes. ![Finalizing the Azure AD Connect configuration](https://adamtheautomator.com/wp-content/uploads/2022/07/image-354.png) Finalizing the Azure AD Connect configuration As you can see below, the configuration enables the password writeback feature. ![Viewing the configuration status](https://adamtheautomator.com/wp-content/uploads/2022/07/image-355.png) Viewing the configuration status 9\. Lastly, wait for the configuration to finish and click Exit to close Azure AD Connect. ![Closing Azure AD Connect](https://adamtheautomator.com/wp-content/uploads/2022/07/image-356.png) Closing Azure AD Connect ## Enabling Password Writeback in Azure Active Directory You’ve enabled password writeback in Azure AD Connect, but you must also ensure that password writeback is enabled in Azure Active Directory. Open the [Azure Active Directory admin center](https://aad.portal.azure.com/) in your web browser. Now, enable password writeback with the following: * Click **Azure Active Directory** → **Password Reset** → **On-Premises Integration**. * Enable the Write back passwords to your on-premises directory and Allow users to unlock accounts without resetting their password options. > _Note: The Allow users to unlock accounts without resetting their password feature is not mandatory for password writeback to work. This feature is optional and only applicable to give users the option to unlock their accounts without resetting their passwords._ * Lastly, click on the Save button to save the changes. ![Enabling password writeback in Azure AD](https://adamtheautomator.com/wp-content/uploads/2022/07/image-357.png) Enabling password writeback in Azure AD > _Note: As of this writing, there is no dedicated PowerShell cmdlet to enable the password writeback feature in Azure AD._ ## Testing Password Writeback After enabling the password writeback feature, you must test the user experience to ensure everything is in good shape. The Azure AD password writeback feature enables your hybrid users to perform password change and reset actions. Follow the steps in the succeeding sections to test both. The following sections use a hybrid / on-premises sync-enabled account called _josh@lazyexchangeadmin.cyou_ to log in to Azure AD. ![Viewing hybrid user accounts in Azure AD](https://adamtheautomator.com/wp-content/uploads/2022/07/image-358.png) Viewing hybrid user accounts in Azure AD ### Password Change Performing a password change is for users who know their old passwords and want to change them. 1\. Navigate to the [My Account](https://myaccount.microsoft.com/) page in your web browser. 2\. Log in using a non-administrator hybrid user account. ![Signing in as a hybrid user](https://adamtheautomator.com/wp-content/uploads/2022/07/image-359.png) Signing in as a hybrid user 3\. On the My Account page, click the [CHANGE PASSWORD](https://account.activedirectory.windowsazure.com/ChangePassword.aspx) link to initiate changing the account’s password. ![Click the change password link](https://adamtheautomator.com/wp-content/uploads/2022/07/image-360.png) Click the change password link 4\. Now, type your old password in the Old password field and your new password in the Create new password, and Confirm new password fields. Click on Submit once you’re happy with the new password to change the account’s password. ![Creating a new password](https://adamtheautomator.com/wp-content/uploads/2022/07/image-361.png) Creating a new password > _Since Azure AD will write the password back, the new password is subject to the password requirements policy in your on-premises AD._ If the new password is unacceptable, you’ll get the error below. ![Getting an error while changing password](https://adamtheautomator.com/wp-content/uploads/2022/07/image-362.png) Getting an error while changing password ### Password Reset On the other hand, the password reset action does not require your old password. This action is best if you forgot your password or your account is locked. > _Note: Resetting a password using the self-service password reset in Azure AD automatically unlocks the user account._ 1\. Open a web browser and navigate to the [self-service password reset](https://passwordreset.microsoftonline.com/) page. 2\. Enter your username and the captcha code and click Next. ![Entering your user account](https://adamtheautomator.com/wp-content/uploads/2022/07/image-363.png) Entering your user account 3\. Select either of the options for getting back to your account: * **I forgot my password** – This option lets you reset your password * **I know my password, but still can’t sign in –** This option unlocks your account instead of resetting your password. In this example, select the I forgot my password option and click Next to initiate resetting your password. ![Initiating password reset](https://adamtheautomator.com/wp-content/uploads/2022/07/image-364.png) Initiating password reset 4\. Now, specify the verification method information. The verification methods are what the users registered when they were first enabled for the self-service password reset. In this example, the verification method is via text message. ![Choose the account verification method](https://adamtheautomator.com/wp-content/uploads/2022/07/image-365.png) Choose the account verification method 5\. Look for the verification code sent to your phone, input the code in the empty field below, and click Next. If the verification code is valid, your browser redirects to a page where you can set your new password. ![Complete the verification challenge](https://adamtheautomator.com/wp-content/uploads/2022/07/image-366.png) Complete the verification challenge 6\. Finally, enter your new password in both fields and click Finish to finalize resetting your password. ![Entering your new password](https://adamtheautomator.com/wp-content/uploads/2022/07/image-367.png) Entering your new password If the password reset is successful, you’ll get a confirmation message, as shown below. ![Confirming the password reset is successful](https://adamtheautomator.com/wp-content/uploads/2022/07/image-368.png) Confirming the password reset is successful > _Like the password change action, resetting the password also adheres to the password policy in your on-premises AD._ > _Extend the functionality of Group Policy and simplify the management of fine-grained password policies. Target any GPO level, group, user, or computer with dictionary and passphrase settings with Specops Password Policy. [Try it Free!](https://specopssoft.com/product/specops-password-policy/?utm_source=ata&utm_medium=referral&utm_campaign=na_2023_ata&utm_content=mention)_ > > > With EasyEntra, first-level support teams can focus on what instead of where! [Manage AD, Entra ID, and Exchange Online](https://easyentra.com/?utm_source=adam&utm_medium=paid&utm_campaign=easyentra&utm_content=standardarticle) from a consolidated, intuitive console. ## Conclusion Enabling password writeback in a hybrid environment is a significant step toward keeping passwords in sync between your on-premises AD and Azure AD. In this tutorial, you’ve gone through how users can change or reset their password or unlock their account directly in Office 365. This task may be daunting at first. But, as this tutorial demonstrated, implementing password writeback is not complicated. So long as you meet the requirements, enabling password writeback is a breeze. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fpassword-writeback%2F&text=Keep%20in%20Sync%20with%20Microsoft%20Azure%20AD%20Sync%20Password%20Writeback)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fpassword-writeback%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fpassword-writeback%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-11.webp) ### [How to Troubleshoot Active Directory Replication Errors](/troubleshoot-active-directory-replication-errors/) Troubleshoot Active Directory replication errors by isolating 1311, 1722, 2087, and USN rollback issues with repadmin, dcdiag, DNS, RPC, and KCC checks. ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-7.webp) ### [Migrate Group Policy to Intune Without Breaking Endpoints](/gpo-intune-migration/) Export GPOs as XML, analyze them with Group Policy Analytics, migrate supported settings to Intune Settings Catalog, and resolve hybrid device conflicts. ![](https://adamtheautomator.com/wp-content/uploads/2026/06/ditch-gpos-intune-featured.webp) ### [Ditch the GPOs: Migrate to Microsoft Intune](/ditch-gpos-migrate-microsoft-intune-2/) Use Group Policy Analytics to migrate GPOs to Intune Settings Catalog profiles, handle unsupported Group Policy Preferences, and manage hybrid AD-to-MDM transitions. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)