Cloud sync for AD to AZ is skipping "Change password at next logon" flag.

I currently have the Password GPO with MinimumPasswordAge as 0. I have also tried disabling and enabling SSPR.

Ok, I know this is cloud sync and not Connect sync, but I wonder if you can check this. I dont want to send you down a rabbit hole :)

https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-cloud-sync-sspr-writeback#powershell

use powershell and import that module and run this:

Get-ADSyncAADCompanyFeature and see if that works and shows what ForcePasswordChangeOnLogon is set to..

I have tried the command listed in the website, however when it prompts me for credentials, I enter the global administrator credentials and it errors with the following:

H, I was wondering if you could run this: Get-ADSyncAADCompanyFeature

not the set command. You probably dont need to specify the credential switch. I am assuming you have MFA enabled there.

When i run the command, it states the command is not recognized, see attachment:

Yes, im currently syncing all users.

I tried changing the password and checked the option "Change password at next logon", the result was: it did not allow the test user to login, it gave the following error:

If i select "forgot my password", it does allow me to change my password and it synchronizes with the on-prem AD, but if I check the "change password at next logon" from AD it does not work. I see this in Microsoft entra cloud sync when I synchronized: