Skip to content

Commit 2e4920f

Browse files
Added writeback note
------- cc: @iainfoulds
1 parent 502f00a commit 2e4920f

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

articles/active-directory/authentication/tutorial-enable-sspr-writeback.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,10 +79,13 @@ To set up the appropriate permissions for password writeback to occur, complete
7979

8080
When you update permissions, it might take up to an hour or more for these permissions to replicate to all the objects in your directory.
8181

82-
Password policies in the on-premises AD DS environment may prevent password resets from being correctly processed. For password writeback to work correctly, group policy for *Minimum password age* must be set to 0. This setting can be found under **Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies** within `gpedit.msc`.
82+
Password policies in the on-premises AD DS environment may prevent password resets from being correctly processed. For password writeback to work most efficiently, the group policy for *Minimum password age* must be set to 0. This setting can be found under **Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies** within `gpedit.msc`.
8383

8484
If you update the group policy, wait for the updated policy to replicate, or use the `gpupdate /force` command.
8585

86+
> [!Note]
87+
> In order for passwords to be changed immediately, password writeback must be set to 0. However, if users adhere to the on-premises policies, and the *Minimum password age* is set to a value greater than zero, password writeback will still work after the on-premises policies are evaluated.
88+
8689
## Enable password writeback in Azure AD Connect
8790

8891
One of the configuration options in Azure AD Connect is for password writeback. When this option is enabled, password change events cause Azure AD Connect to synchronize the updated credentials back to the on-premises AD DS environment.

0 commit comments

Comments
 (0)