How to Audit Password Changes in Microsoft 365

Identifying frequent or abnormal password changes in Microsoft 365 is essential for detecting potential security threats, such as compromised accounts or unauthorized access attempts.

In Microsoft 365, there is no direct method to set alerts for password changes, so regular monitoring of logs is necessary to identify any unusual password reset activity. Consistent oversight helps detect abnormal patterns, such as frequent changes, that could signal security threats.

With AdminDroid's user password changes alert, you get real-time alerts for every password change event in your organization. This ensures immediate awareness of any unusual activity, enhancing overall security without the need for manual log analysis.

Tracking the last password change helps you identify how often users update their passwords, ensuring adherence to company password policies and preventing the use of stale passwords that could lead to security breaches.

You can use the Get-MgUser PowerShell cmdlet to retrieve the last password change date and time information. However, retrieving the last password change for multiple users, along with other password-related metrics, requires multiple filtering processes and complicates the process.

Here's a quick glimpse!

In Microsoft 365, the default password policy defines a secure password structure, including the password validity period (90 days), password expiration notification period (14 days), and the organization’s Microsoft 365 password policy settings.

However, admins can adjust these settings according to their organization’s needs. Therefore, it’s essential to know your organization's password expiration policy to ensure timely password updates and avoid disruptions to important systems.

• In the Microsoft 365 admin center, navigate to Settings»Org Settings.
• Click on Password expiration policy under the Security & privacy tab.
• Here, you view the password expiration policy of your organization.

Note: The Microsoft admin center only provides the password expiration policy. For additional details, such as password expiration notifications and users with passwords that never expire, use the PowerShell cmdlets.

Run the cmdlet below to examine your organization's password expiration policy and password expiry notification days.

Connect-MgGraph -Scopes "Domain.Read.All"
Get-MgDomain -DomainID <Domain name> | select -Property Id, PasswordNotificationWindowInDays, PasswordValidityPeriodInDays

Use the following cmdlet to identify users users whose passwords are set to never expire.

Get-MgUser -All -Property UserPrincipalName, PasswordPolicies | Select-Object UserprincipalName,@{N="PasswordNeverExpires" E={$_.PasswordPolicies -contains 'DisablePasswordExpiration'}} 

• To get the password policies for all your domains in a single detailed report, use AdminDroid's Password Policy report.
• This report shows details like password validity, how many users the policy applies to, how many bypass it, and the password expiration notification days for each domain.

By analyzing password expiry dates, you can notify users in advance to change their passwords, reducing the risk of forgotten password changes.

While the admin centers helps you retrieve the last password change date and your organization's password policy, manual calculations are necessary to determine the password expiry date. However, this can create discrepancies when some users have passwords set to never expire.

Here's a quick glimpse!