How to Check Users Last Password Change Date in Microsoft 365

Micriosoft 365 users who never change their passwords pose a significant security risk due to increased vulnerability to credential theft and compliance violations. So, it is mandatory to check password changes regularly.

There is no exact method or option to find a user who never changed a password in Microsoft 365. However, we can identify those users by comparing the Last password change date time and Created date time columns.

Follow the below steps.

• It gives details, such as UPN, Microsoft 365 user creation time, password expiration date, weak password status, etc.
• You can save the report in your local using 'Download/Export' option.

Many organizations enforce password policies requiring users to change their passwords every 90 days or (appx 3 months). However, some users may not consistently adhere to these guidelines. This lack of compliance can lead to account lockouts and decreased productivity, posing security risks.

There is no direct method to find password age. However, we can find the users who haven't changed their passwords for the last 90 days using PowerShell.

Connect to the Microsoft Graph module and run the below cmdlets.

Connect-MgGraph
$PolicyDays = (Get-Date).AddDays(-90)
$users=Get-MgBetaUser -All -Property DisplayName, UserPrincipalName, LastPasswordChangeDateTime, PasswordPolicies |  Where-Object {$_.LastPasswordChangeDateTime -lt $PolicyDays } $users | Select-Object DisplayName, UserPrincipalName, LastPasswordChangeDateTime

When Microsoft 365 users are attempting to sign in with incorrect passwords or accessing from restricted locations, the first line of defense is to enforce a password reset. This prevents unauthorized access of an attacker who guessed a previously used password.

Run the following cmdlet to force a password change for all M365 users.

Connect-MgGraph -Scopes User.ReadWrite.All $Allusers = Get-Mguser –all         $PasswordProfile =@{ForceChangePasswordNextSignIn=$true} Foreach ($user in $Allusers) {$upn=$user.UserPrincipalName Update-MgUser  –UserId $upn            -PasswordProfile  $PasswordProfile} 

Run the below cmdlet to force change password for a single M365 user.

Connect-MgGraph -Scopes User.ReadWrite.All      $PasswordProfile=@{ForceChangePasswordNextSignIn=$true} Update-MgUser -UserId <UPN> -PasswordProfile  $PasswordProfile

When users forget their passwords or if their accounts are locked out, SSPR enables them to quickly reset their passwords and regain access to their accounts. This reduces downtime and improves productivity. Follow the steps to enable SSPR for users in your M365 environment.

• It shows the password reset time along with the result status, etc.
• By analyzing this report, admins can monitor all self-service password resets and prevent unauthorized usage of user accounts.

When considering the implementation of password expiration emails for M365 users, it's vital to understand the current landscape, password expiration notifications are no longer supported within the Microsoft 365 admin center and Microsoft 365 apps.

If a user fails to reset their password before the expiry date, it can result in an account lockout, which in turn reduces user productivity.

you can easily schedule reports to run in advance of password expiration, selecting from choices like seven days in advance or tailoring them to meet their unique needs. This feature enhances security measures while providing administrators with flexibility and ease of management.