Skip to main content

​
SYNOPSIS

Retrieves and processes user password information from Microsoft Graph and get information about the user’s password, such as the last password change date, on-premises sync status, and password policies.

​
SYNTAX

Get-MgUserPasswordInfo [[-UserPrincipalName] <String[]>] [-OnlyDomainPasswordPolicies] [-OnlySyncedUsers]
 [[-FilterByDomain] <String>] [-IncludeGuestUsers] [-IncludeExchangeDetails] [-ExportToExcel]
 [[-SimulatedMaxPasswordAgeDays] <Int32>] [-OnlyUsersWithForceChangePasswordNextSignIn]
 [-ProgressAction <ActionPreference>] [<CommonParameters>]

​
DESCRIPTION

The Get-MgUserPasswordInfo script collects details such as the user’s principal name, last password change date, on-premises sync status, and password policies.

​
EXAMPLES

​
EXAMPLE 1

Get-MgUserPasswordInfo
Retrieves password information for all users and outputs it (default behavior).

​
EXAMPLE 2

Get-MgUserPasswordInfo -UserPrincipalName xxx@domain.com
Retrieves password information for the specified user and outputs it.

​
EXAMPLE 3

Get-MgUserPasswordInfo -OnlyDomainPasswordPolicies
Retrieves password policies for all domains only.

​
EXAMPLE 4

Get-MgUserPasswordInfo -FilterByDomain "contoso.com"
Retrieves password information for users in the contoso.com domain only.

​
EXAMPLE 5

Get-MgUserPasswordInfo -SimulatedMaxPasswordAgeDays 180
Retrieves password information for all users and simulates what would happen with a 180-day password expiration policy, showing both current and simulated expiration dates.

​
PARAMETERS

​
-UserPrincipalName

Specifies the user principal name(s) of the user(s) for which to retrieve password information. 
Type: String[]
Parameter Sets: (All)
Aliases:

Required: False
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

​
-OnlyDomainPasswordPolicies

If specified, retrieves password policies for domains only, without retrieving individual user information. 
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

​
-OnlySyncedUsers

If specified, retrieves password information for synchronized users only (OnPremisesSyncEnabled = $true). 
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

​
-FilterByDomain

Specifies a domain name to filter users. Only users from the specified domain will be retrieved (excluding guest users). 
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

​
-IncludeGuestUsers

{{ Fill IncludeGuestUsers Description }} 
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

​
-IncludeExchangeDetails

Include Exchange Online mailbox details in the output, useful to exclude shared mailboxes and others. 
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

​
-ExportToExcel

(Optional) If specified, exports the results to an Excel file in the user’s profile directory. 
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

​
-SimulatedMaxPasswordAgeDays

An optional parameter to simulate password expiration based on a specified maximum password age in days. If provided, the function will calculate a simulated password expiration date and indicate whether the password would be expired based on this simulated age. 
Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: 3
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False

​
-OnlyUsersWithForceChangePasswordNextSignIn

If specified, retrieves password information for users who have ForceChangePasswordNextSignIn set to true only. 
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

​
CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

​
INPUTS

​
OUTPUTS

​
NOTES

Ensure you have the necessary permissions and modules installed to run this script, such as the Microsoft Graph PowerShell module. The script assumes that the necessary authentication to Microsoft Graph has already been handled with the Connect-MgGraph function. Connect-MgGraph -Scopes ‘User.Read.All’, ‘Domain.Read.All’, ‘OnPremDirectorySynchronization.Read.All’ Password policies for cloud-only users: IF PasswordPolicies is ‘DisablePasswordExpiration’: THEN password never expires ELSEIF PasswordPolicies is ‘None’ or null:IFdomain′s‘PasswordValidityPeriodInDays‘is2147483647ornull: IF domain's `PasswordValidityPeriodInDays` is 2147483647 or null: THEN password never expires ELSE: password expires based on the domain’s PasswordValidityPeriodInDays ELSE: IF domain’s PasswordValidityPeriodInDays is 2147483647 or $null THEN password never expires ELSE password expires based on the domain’s PasswordValidityPeriodInDays Password policies for synchronized users: IF CloudPasswordPolicyForPasswordSyncedUsersEnabled is enabled: IF PasswordPolicies is ‘None’ or $null: THEN password expires based on the domain’s PasswordValidityPeriodInDays (same as cloud-only users above) ELSEIF PasswordPolicies is ‘DisablePasswordExpiration’: THEN password never expires ELSE: THEN password expires based on the domain’s PasswordValidityPeriodInDays (same as cloud-only users above) ELSE (CloudPasswordPolicyForPasswordSyncedUsersEnabled is disabled): THEN password never expires Side note : When we manually want to set Password Policies to follow domain policies, we need to set PasswordPolicies ‘None’ via Microsoft Graph API because $null is not accepted. https://ps365.clidsys.com/docs/commands/Get-MgUserPasswordInfo