> ## Documentation Index
> Fetch the complete documentation index at: https://ps365.clidsys.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get-MgUserPasswordInfo

## SYNOPSIS

Retrieves and processes user password information from Microsoft Graph and get information about the user's password, such as the last password change date, on-premises sync status, and password policies.

## SYNTAX

```powershell theme={null}
Get-MgUserPasswordInfo [[-UserPrincipalName] <String[]>] [-OnlyDomainPasswordPolicies] [-OnlySyncedUsers]
 [-FilterByDomain <String>] [-IncludeGuestUsers] [-IncludeExchangeDetails] [-ExportToExcel]
 [-SimulatedMaxPasswordAgeDays <Int32>] [-OnlyUsersWithForceChangePasswordNextSignIn]
 [-ProgressAction <ActionPreference>] [<CommonParameters>]
```

## DESCRIPTION

The Get-MgUserPasswordInfo script collects details such as the user's principal name, last password change date, on-premises sync status, and password policies.

## EXAMPLES

### EXAMPLE 1

```powershell theme={null}
Get-MgUserPasswordInfo
```

Retrieves password information for all users and outputs it (default behavior).

### EXAMPLE 2

```powershell theme={null}
Get-MgUserPasswordInfo -UserPrincipalName xxx@domain.com
```

Retrieves password information for the specified user and outputs it.

### EXAMPLE 3

```powershell theme={null}
Get-MgUserPasswordInfo -OnlyDomainPasswordPolicies
```

Retrieves password policies for all domains only.

### EXAMPLE 4

```powershell theme={null}
Get-MgUserPasswordInfo -FilterByDomain "contoso.com"
```

Retrieves password information for users in the contoso.com domain only.

### EXAMPLE 5

```powershell theme={null}
Get-MgUserPasswordInfo -SimulatedMaxPasswordAgeDays 180
```

Retrieves password information for all users and simulates what would happen with a 180-day password expiration policy, showing both current and simulated expiration dates.

## PARAMETERS

### -UserPrincipalName

Specifies the user principal name(s) of the user(s) for which to retrieve password information.

```yaml theme={null}
Type: String[]
Parameter Sets: (All)
Aliases: Identity

Required: False
Position: 1
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```

### -OnlyDomainPasswordPolicies

If specified, retrieves password policies for domains only, without retrieving individual user information.

```yaml theme={null}
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```

### -OnlySyncedUsers

If specified, retrieves password information for synchronized users only (OnPremisesSyncEnabled = \$true).

```yaml theme={null}
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```

### -FilterByDomain

Specifies a domain name to filter users.
Only users from the specified domain will be retrieved (excluding guest users).

```yaml theme={null}
Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```

### -IncludeGuestUsers

\{\{ Fill IncludeGuestUsers Description }}

```yaml theme={null}
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```

### -IncludeExchangeDetails

Include Exchange Online mailbox details in the output, useful to exclude shared mailboxes and others.

```yaml theme={null}
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```

### -ExportToExcel

(Optional) If specified, exports the results to an Excel file in the user's profile directory.

```yaml theme={null}
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```

### -SimulatedMaxPasswordAgeDays

An optional parameter to simulate password expiration based on a specified maximum password age in days.
If provided, the function will calculate a simulated password expiration date and indicate whether the password would be expired based on this simulated age.

```yaml theme={null}
Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
```

### -OnlyUsersWithForceChangePasswordNextSignIn

If specified, retrieves password information for users who have ForceChangePasswordNextSignIn set to true only.

```yaml theme={null}
Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
```

### CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see [about\_CommonParameters](http://go.microsoft.com/fwlink/?LinkID=113216).

## INPUTS

## OUTPUTS

## NOTES

Ensure you have the necessary permissions and modules installed to run this script, such as the Microsoft Graph PowerShell module.
The script assumes that the necessary authentication to Microsoft Graph has already been handled with the Connect-MgGraph function.
Connect-MgGraph -Scopes 'User.Read.All', 'Domain.Read.All', 'OnPremDirectorySynchronization.Read.All', 'AuditLog.Read.All'

Password policies for *cloud-only* users:
IF `PasswordPolicies` is 'DisablePasswordExpiration':
THEN password never expires
ELSEIF `PasswordPolicies` is 'None' or $null:
    IF domain's `PasswordValidityPeriodInDays` is 2147483647 or $null:
THEN password never expires
ELSE:
password expires based on the domain's `PasswordValidityPeriodInDays`
ELSE:
IF domain's `PasswordValidityPeriodInDays` is 2147483647 or \$null
THEN password never expires
ELSE
password expires based on the domain's `PasswordValidityPeriodInDays`

Password policies for *synchronized* users:
IF `CloudPasswordPolicyForPasswordSyncedUsersEnabled` is enabled:
IF `PasswordPolicies` is 'None' or \$null:
THEN password expires based on the domain's `PasswordValidityPeriodInDays` (same as cloud-only users above)
ELSEIF `PasswordPolicies` is 'DisablePasswordExpiration':
THEN password never expires
ELSE:
THEN password expires based on the domain's `PasswordValidityPeriodInDays` (same as cloud-only users above)
ELSE (CloudPasswordPolicyForPasswordSyncedUsersEnabled is disabled):
THEN password never expires

Side note : When we manually want to set Password Policies to follow domain policies, we need to set PasswordPolicies 'None' via Microsoft Graph API because \$null is not accepted.

## RELATED LINKS

[https://ps365.clidsys.com/docs/commands/Get-MgUserPasswordInfo](https://ps365.clidsys.com/docs/commands/Get-MgUserPasswordInfo)