How to enable password writeback in Entra ID

Introduction

In an organization configured as hybrid with Microsoft cloud, user accounts are created in the on-premises Active Directory and are synchronized with Microsoft Entra ID. In order for users to change their password in cloud applications, it must be synchronized with their on-premises account so that they can use a single password.

Prerequisites

Active Directory

An Active Directory server configured and accounts created.

Entra Connect

An Entra Connect instance connected with Entra ID.

Administrator role

An account with the Global Administrator or Hybrid Identity Administrator role to access the Microsoft Entra Admin Center.
An account with the Enterprise Administrator role to access the Active Directory server.

Step 1 : Enable Password Writeback in Microsoft Entra Connect Options

Start the Microsoft Entra Connect Sync application from the local Entra Connect server.

On the setup wizard welcome screen, click Configure.

Click Customize synchronization options, then Next.

Enter your Microsoft 365 administrator account, then click Next.

Check the Password writeback box, then click Next.

On the last menu, click Exit.

The feature is now enabled on the local Entra Connect server.

Step 3 : Enable Password Writeback in Microsoft Entra ID

In the left menu, click Identity, then Protection, and then Password reset.

Click On-premises integration, and enable all options.

The feature is now enabled on Entra ID.

Step 4 : Set a Minimum Password Age Policy

Start the GPO Management Console (gpmc.msc) from the local Active Directory server.

Click Computer Configuration, then Policies, then Windows Settings, then Security Settings, then Account Policy, and then Password Policy.

Edit the Minimum password age policy and set it to 0 days.