Unable to get the values from the PasswordProfile property of Get-MgUser

[laage]

I needed to disable the force password change on first logon on a number of new cloud-only users in Entra.

And I’m pretty sure I fixed that with this snippet ($UserList contained the users in question):

$PasswordProfile = @{
  ForceChangePasswordNextSignIn = $false
}

foreach ($u in $UserList) { Update-MgUser -userid $u.UserPrincipalName -PasswordProfile $PasswordProfile }

However, I prefer to verify these kinds of changes, but I’m apparently missing something since I’m not able to see the values in PasswordProfile.

If I run Get-MgUser -UserId user01@test.com -ExpandProperty PasswordProfile, I get this error message:

get-mguser : Parsing OData Select and Expand failed: Property 'PasswordProfile' on type 'microsoft.graph.user' is not a navigation property or complex proper
ty. Only navigation properties can be expanded.
Status: 400 (BadRequest)                                                                                                                                      
ErrorCode: BadRequest                                                          

On the other hand if I run Get-MgUser -UserId user01@test.com | Select -ExpandProperty PasswordProfile, I get the following:

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------

But no values for the different properties. And it was the same both before and after I ran the Update-MgUser command.

What am I missing? And how do I display the values in the three properties here and for other similar jobs?

[krzydoug]

Yeah I can’t figure it out either. I thought it was as simple as not including the -Property or -Select on the Get-MGUser call… but nothing worked. IMO this whole module is trash. Especially compared to AzureAD or MSonline. I’ll be waiting for someone else to come tell us the secret sauce on this. What a joke.

[matt-bloomfield]

Working for me although I’ve not updated the module for a while so I’m on 2.11.1.

Get-MgUser -UserId testUser01@xxxxx.onmicrosoft.com -Property PasswordProfile | 
    Select-Object -ExpandProperty PasswordProfile

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------
True                          False

Edit: updated and it’s working OK on 2.20.0 too.

[laage]

Thank you both!

Unfortunately that just seems to make things even odder.

I’m on 2.19.0 and I’m seeing the same behavior on both PS 5.1 and PS 7.4.3. Same behavior on my work-tenant and my developer-tenant.
Though I’m getting a fancy green color for the properties on 7.4.3

Testing an upgrade to 2.20.0, but no change for me:

Just to add to this I can say that I was seeing similar behavior with the ‘Manager’ property.
It too contains a number of sub-properties and I didn’t see any of them at first, when doing Get-MgUser -UserId user01@test.com -Property Manager | Select-Object -ExpandProperty Manager. It just showed me this:

Id DeletedDateTime
-- ---------------

However if i run Get-MgUser -UserId user01@test.com -ExpandProperty Manager, I don’t get the ‘Parsing OData Select and Expand failed…’ error message i saw with the PasswordProfile-property, it just lists the DisplayName, Id, Mail and UserPrincipalName of the user in question. And if I pipe the above to Select-Object -ExpandProperty Manager. I actually get an ID matching the correct manager.

Id                                   DeletedDateTime
--                                   ---------------
12345678-1234-1234-1234-1234567890123

[matt-bloomfield]

Do you get anything back if you make the request directly?

Invoke-MgGraphRequest -Uri 'https://graph.microsoft.com/v1.0/users/testuser01@xxxxx.onmicrosoft.com?$select=passwordProfile' | 
     Select-Object -ExpandProperty passwordProfile

[laage]

I haven’t got much time right now, so I’ll be back with more info later. But no, I’m not getting anything with that on PS 7.4.3 / MSGraph 2.20.0 (Dev-tenant).
On PS 5.1 / MSGraph 2.19.0 (Work-tenant) I get this error:

Select-Object : Property "PasswordProfile" cannot be found.
At line:1 char:119
+ ... lect=passwordProfile' | Select-Object -ExpandProperty PasswordProfile
+                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (System.Collections.Hashtable:PSObject) [Select-Object], PSArgumentException
    + FullyQualifiedErrorId : ExpandPropertyNotFound,Microsoft.PowerShell.Commands.SelectObjectCommand

I tried copying the entire command and just changing the UPN to a valid for either tenant.
I also tried with just to first part of the cmdlet and that just gave me this on both tenants and PS versions:

Name                           Value
----                           -----
@odata.context                 https://graph.microsoft.com/v1.0/$metadata#users(passwordProfile)/$entity
passwordProfile

[matt-bloomfield]

To rule out (or confirm) local problems, can you check if your tenants return the data when querying from Graph Explorer?

Graph Explorer | Try Microsoft Graph APIs - Microsoft Graph

Expected response:

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users(passwordProfile)/$entity",
    "passwordProfile": {
        "password": null,
        "forceChangePasswordNextSignIn": true,
        "forceChangePasswordNextSignInWithMfa": false
    }
}

If that works, I’d try removing all versions of the Graph module and just installing just the latest one. I’ve had weird problems when multiple versions are installed side-by-side.

[laage]

No go!

I’ve tried with both v1.0 and Beta and I’m getting similar results from both Work and Dev-tenant.
On v1.0, I’m just getting this:

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users(passwordProfile)/$entity",
    "passwordProfile": null
}

On Beta I’m getting almost the same it just adds a line with the user Object Id:

{
    "@odata.context": "https://graph.microsoft.com/beta/$metadata#users(passwordProfile)/$entity",
    "id": "[USER OBJECT ID]",
    "passwordProfile": null
}

I’m using the same query as in Invoke-MgGraphRequest cmdlet used previously: https://graph.microsoft.com/v1.0/users/testuser01@xxxxx.onmicrosoft.com?$select=passwordProfile.

[matt-bloomfield]

I think this is a permissions problem. Do you have the User.Read.All permission?

[krzydoug]

I connected with User.ReadWrite.All and was getting the same thing. Let me check the graph explorer as well.

[matt-bloomfield]

I replicated it in Graph Explorer by testing with a user that had only User.ReadBasic.All. Have now tested with the Graph SDK:

PS C:\Users\Matt B> (Get-MgContext).Scopes
openid
profile
User.ReadBasic.All
email
PS C:\Users\Matt B> (Get-MgUser -UserId testUser01@xxxxx.onmicrosoft.com -Property passwordProfile).passwordProfile

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------

PS C:\Users\Matt B> (Get-MgContext).Scopes
openid
profile
User.ReadBasic.All
email
User.Read.All
PS C:\Users\Matt B> (Get-MgUser -UserId testUser01@xxxxx.onmicrosoft.com -Property passwordProfile).passwordProfile

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------
True                          False

[laage]

I’d hoped that would be it… I had the ‘Directory.AccessAsUser.All’-scope set as that was required to set the ForceChangePasswordNextSignIn property.

I re-logged on with both ‘User.Read.All’ and ‘Directory.AccessAsUser.All’ scope. Alas, no dice:

PS > (Get-MgContext).Scopes                                                                                                           10:24:07
Directory.AccessAsUser.All
openid
profile
email
User.Read.All

PS > get-mguser -UserId user01@test.com -Property Passwordprofile | select -ExpandProperty passwordprofile                           10:25:09

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------



PS > (Get-MgUser -UserId user01@test.com -Property passwordProfile).PasswordProfile                                                  10:25:43

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------

[matt-bloomfield]

Is the account sync’d from on-premises AD? All my testing has been in a dev tenant that is not syncing.

Do you have anything enabled in the tenant that might affect this, like self-service password reset?

[laage]

This all started in my work-tenant - which has most of the accounts synced from on-prem AD. However, we’d added a number of cloud-only accounts and those accounts should be excluded from the default forced password change. I’d thought I’d find it directly in Entra, but no such luck.
With a little digging I found the PS to change the setting, which seemed to work (at least it gave no error message). But when I went to verify the change I ran into this whole mess.

My Dev-tenant is entirely cloud-only, no on-prem connectivity at all.

Just to be entirely sure I reran the above on my Work-tenant (PS 5.1 / MGraph 2.19.0) on both my personal synced user and one of the new cloud only accounts and I’m still not seeing values on either the ‘ForceChangePasswordNextSignIn’ or ‘ForceChangePasswordNextSignInWithMfa’ property.

[matt-bloomfield]

I have done some additional testing and as far I can tell when you set ForceChangePasswordNextSignIn to $false it doesn’t actually have the value $false. It’s either $true or $null.

[laage]

Seriously!?

All that work for a $null-value?
Don’t get me wrong @matt-bloomfield. Thank you! I really appreciate the work you put into this, but this is just infuriating!

All the accounts I’ve tested against previously have been existing accounts, but with your last comment I set up two entirely new accounts in my Dev-tenant. ‘mfatest’ was setup as a regular user with licensing and MFA set via CA-policies and group membership. ‘nomfatest’ was assigned a license directly and was excluded from MFA in the CA-policy.

PS > (Get-MgContext).Scopes                                                                                                                           09:00:46 Directory.AccessAsUser.All
openid
profile
User.Read.All
email
PS > (Get-MgUser -UserId mfatest@test.com -Property passwordProfile).PasswordProfile                                                              

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------
True                          False


PS > (Get-MgUser -UserId nomfatest@test.com -Property passwordProfile).PasswordProfile                                                            

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------
True                          False


PS > $PasswordProfile = @{ ForceChangePasswordNextSignIn = $false }                                                                                   
PS > Update-MgUser -UserId nomfatest@test.com -PasswordProfile $PasswordProfile                                                                   
PS > (Get-MgUser -UserId mfatest@test.com -Property passwordProfile).PasswordProfile                                                              

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------
True                          False


PS > (Get-MgUser -UserId nomfatest@test.com -Property passwordProfile).PasswordProfile                                                            

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------

And just to add insult to injury:

PS > $PasswordProfile = @{ ForceChangePasswordNextSignInWithMfa = $true }                                                                             
PS > Update-MgUser -UserId nomfatest@test.com -PasswordProfile $PasswordProfile                                                                   
PS > (Get-MgUser -UserId nomfatest@test.com -Property passwordProfile).PasswordProfile                                                            

ForceChangePasswordNextSignIn ForceChangePasswordNextSignInWithMfa Password
----------------------------- ------------------------------------ --------
False                         True

If I update the ForceChangePasswordNextSignInWithMfa-property it actually sets a $false-value in the ForceChangePasswordNextSignIn-property instead of a $null!