Check for Password Expired Users in Microsoft 365 using Graph PowerShell

Managing password expirations is crucial for maintaining the security of your Microsoft 365 environment. In this article, we'll provide a Graph PowerShell script to check for users with expired passwords, explain how the script works, explore ways to enhance it, discuss possible errors and their solutions, and wrap up with a conclusion.

The Script

Here's the Graph PowerShell script to identify users with expired passwords in Microsoft 365:

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.Read.All"

# Get all users
$users = Get-MgUser -All -Property "DisplayName,UserPrincipalName,PasswordPolicies,AccountEnabled,SignInActivity"

# Filter users with expired passwords
$expiredPasswordUsers = $users | Where-Object { $_.SignInActivity.LastPasswordChangeDateTime -lt (Get-Date).AddDays(-90) }

# Display the users with expired passwords
$expiredPasswordUsers | Select-Object DisplayName, UserPrincipalName, AccountEnabled, @{Name="LastPasswordChange";Expression={$_.SignInActivity.LastPasswordChangeDateTime}}

# Disconnect from Microsoft Graph
Disconnect-MgGraph

How the Script Works

1. Connect to Microsoft Graph: The script starts by authenticating to Microsoft Graph using the Connect-MgGraph cmdlet. The scope "User.Read.All" is required to read user information.
2. Get All Users: The Get-MgUser cmdlet retrieves all users in the tenant along with relevant properties such as DisplayName, UserPrincipalName, PasswordPolicies, AccountEnabled, and SignInActivity.
3. Filter Users with Expired Passwords: The script uses the Where-Object cmdlet to filter out users whose passwords have expired. This is determined by checking if the LastPasswordChangeDateTime is older than 90 days from the current date.
4. Display Results: The filtered list of users with expired passwords is formatted and displayed using the Select-Object cmdlet.
5. Disconnect from Microsoft Graph: Finally, the script disconnects from Microsoft Graph using the Disconnect-MgGraph cmdlet.

Note: Modify 90 days to suit your tenant's password expiration policy.

Enhancing the Script

The script can be further enhanced in several ways:

• Customizable Expiration Period: Allow the password expiration period to be passed as a parameter to make the script more flexible.
• Email Notifications: Integrate an email notification system to alert administrators or users when passwords are about to expire or have expired.
• Logging: Implement logging to capture script execution details and results for auditing purposes.
• Error Handling: Add more robust error handling to ensure the script can gracefully handle exceptions.

Here is an enhanced version of the script with customizable expiration period and basic error handling:

param (
    [int]$ExpirationDays = 90
)

try {
    # Connect to Microsoft Graph
    Connect-MgGraph -Scopes "User.Read.All"

    # Get all users
    $users = Get-MgUser -All -Property "DisplayName,UserPrincipalName,PasswordPolicies,AccountEnabled,SignInActivity"

    # Filter users with expired passwords
    $expiredPasswordUsers = $users | Where-Object { $_.SignInActivity.LastPasswordChangeDateTime -lt (Get-Date).AddDays(-$ExpirationDays) }

    # Display the users with expired passwords
    $expiredPasswordUsers | Select-Object DisplayName, UserPrincipalName, AccountEnabled, @{Name="LastPasswordChange";Expression={$_.SignInActivity.LastPasswordChangeDateTime}}
}
catch {
    Write-Error "An error occurred: $_"
}
finally {
    # Disconnect from Microsoft Graph
    Disconnect-MgGraph
}

Possible Errors and Solutions

Error: Connect-MgGraph : A positional parameter cannot be found that accepts argument 'User.Read.All'.

Solution: Ensure you have the Microsoft.Graph module installed and updated. You can install or update it using:

Install-Module Microsoft.Graph -Scope CurrentUser -Force
Update-Module Microsoft.Graph

Error: Get-MgUser : Insufficient privileges to complete the operation.

Solution: Make sure your account has the necessary permissions to read user information. You may need to consent to the required permissions or contact your admin to grant the appropriate roles.

Error: An error occurred: <error message>

Solution: The script includes basic error handling using a try-catch-finally block. Ensure that the finally block correctly disconnects from Microsoft Graph even if an error occurs. Review the error message for specific details and troubleshoot accordingly.

Conclusion

Regularly checking for password expirations is a vital part of maintaining a secure Microsoft 365 environment. The provided Graph PowerShell script enables you to efficiently identify users with expired passwords. By enhancing the script with additional features such as customizable expiration periods, email notifications, and logging, you can make it even more powerful and user-friendly. Additionally, handling possible errors effectively ensures smooth script execution and minimizes disruptions.

Related Articles:

Using Get-MgDirectoryRole in Graph PowerShell
Using Get-MgUserLicenseDetail in Graph PowerShell
Using Find-GraphMgCommand in Graph PowerShell
Connect to Microsoft 365 Using PowerShell
How to Create Bulk Users in Office 365 Using Graph PowerShell?
Create Microsoft 365 Group Using Microsoft Graph PowerShell
Block Microsoft 365 User Using Microsoft Graph PowerShell
Assign Microsoft 365 License Using Graph PowerShell
Microsoft 365 User Management Using Graph PowerShell
Checking Group Membership in Microsoft 365
Bulk Assign Microsoft 365 License
Find Inactive Users in Microsoft 365
Using Powershell Graph Search Query
Using Powershell Graph Filter Query
Using Where-Object In Graph PowerShell
Using Expand Property In Graph PowerShell
Using Select Object In Graph PowerShell
Using -Contains Operator In Graph PowerShell
Add User to Multiple Microsoft 365 Groups Using Graph PowerShell
Get Microsoft 365 User Location Using Graph PowerShell
Import Microsoft 365 Groups from CSV File Using Graph PowerShell
Microsoft 365 Group User Import Using Graph PowerShell