Request for Assistance: Locating Azure Password Reset Log and Understanding Circumstances

Travis Hawk 20 Reputation points
2024-03-09T20:38:25.3866667+00:00

I am writing to inquire about the recent forced password reset on my Azure account. I noticed that my password was reset without my initiation, and I would like to locate the log showing if the forceChangePasswordNextSignIn was used or if was a result of time limits. I have changed my password several times and the time limits are set at 365 days. I'm curious if the 365 day setting is from account creation or if it resets every time the password is reset.

My Microsoft 365 F3 password was different from my PC password but I was forced to reset both so I don't know if it was the 365 day setting or a person forcing the issues playing around in the admin portal.

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,818 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,774 questions
Microsoft Intune Security
Microsoft Intune Security
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
370 questions
0 comments
Accepted answer
  1. Yanhong Liu 4,650 Reputation points Microsoft Vendor
    2024-03-11T09:21:10.37+00:00

    Hello Travis Hawk，

    Thank you for posting in Q&A forum.

    To find the logging related to the forceChangePasswordNextSignIn  property, you need to check the audit logs for Azure Active Directory (AAD). Here are the steps to find the relevant logs:

    1. Log in to the Azure portal.
    2. Navigate to Azure Active Directory.
    3. In the Azure Active Directory menu, select Activity > Audit logs.
    4. In the audit log search filter, you can filter by:

    Time range: Select the date and time period associated with the password reset.

    User: Enter the name of the affected user account.

    Action Category: Find actions related to password changes or password policies, such as those under the User Management or Password Management categories.

    1. Pay special attention to look for events with event ID 4724, which indicates that the password has been set to have to be changed the next time you log in. In the event details, if you see information about forceChangePasswordNextSignIn, it usually means that the property is set to True.

    You mentioned that the time limit for password changes is set at 365 days. This setting is created based on your account, not every time you reset your password. So, even if you change your password multiple times, the setting will remain the same until you reach the 365-day limit.

    I hope the information above is helpful.

    If you have any questions or concerns, please feel free to let us know.

    Best Regards,

    Yanhong Liu

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    1 person found this answer helpful.
    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Suwarna S Kale 301 Reputation points
    2024-03-10T04:44:19.71+00:00

    Thanks for posting your question in the Microsoft Q&A forum.

    Administrators can reset a user’s password in various scenarios, including when the password is forgotten, the user is locked out of a device, or if the user never received a password. If you’re not an administrator and need instructions on how to reset your own work or school password, you can use the Self-Service Password Reset (SSPR) wizard. The method used to reset your password might provide insights into why it occurred.

    You mentioned that the time limits for password changes are set at 365 days. This setting typically refers to the maximum password age, which determines how long a password can be used before it must be changed. Please clarify whether this 365-day setting is tied to account creation or if it resets every time the password is changed.

    Does the response help answer your question? Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution. Thanks 😊

    1 person found this answer helpful.
  2. Yanhong Liu 4,650 Reputation points Microsoft Vendor
    2024-03-11T08:09:37.15+00:00

    Hello Travis Hawk，

    Thank you for posting in Q&A forum.

    To find the logging related to the forceChangePasswordNextSignIn  property, you need to check the audit logs for Azure Active Directory (AAD). Here are the steps to find the relevant logs:

    1. Log in to the Azure portal.
    2. Navigate to Azure Active Directory.
    3. In the Azure Active Directory menu, select Activity > Audit logs.
    4. In the audit log search filter, you can filter by:

    Time range: Select the date and time period associated with the password reset.

    User: Enter the name of the affected user account.

    Action Category: Find actions related to password changes or password policies, such as those under the User Management or Password Management categories.

    1. Pay special attention to look for events with event ID 4724, which indicates that the password has been set to have to be changed the next time you log in. In the event details, if you see information about forceChangePasswordNextSignIn, it usually means that the property is set to True.

    You mentioned that the time limit for password changes is set at 365 days. This setting is created based on your account, not every time you reset your password. So, even if you change your password multiple times, the setting will remain the same until you reach the 365-day limit.

    I hope the information above is helpful.

    If you have any questions or concerns, please feel free to let us know.

    Best Regards,

    Yanhong Liu

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    1 person found this answer helpful.