Tried Azure AD Connect, now none of the users can reset their password

azure-active-directorymicrosoft-office-365

We're running Office 365 with Azure AD free version and used to run an old Windows 2012 R2 Essentials server with a local domain.

I thought it would be a cool idea to upgrade our server to 2019 Standard to get that sweet Azure AD integration.. or so I thought.

Server upgrade went fine and everything was cool until I decided to try Azure AD Connect. I thought we could use the Password Writeback feature for free. When I found out I was wrong and we needed to pay an additional $8 or so per month per user I decided to drop the idea, and ran the Azure AD Connect tool to disable Password Writeback.

However now all non-admin users can no longer change their passwords via their PC's (CTRL-ALT-DEL) or even via Office 365.

The message that comes up is:

you can’t change your password here.
Your organization doesn’t allow you to change your password on this site. Please change your password according to the method recommended by your organization, or ask your admin if you need help

Now no matter what I try I can't revert things to the way they were. I've ran the Azure AD Connect configuration tool and re-enabled Password Writeback and disabled it again multiple times. I've exported the current configuration settings and it is showing me that Password Writeback is disabled.

I've also disabled all other features of Azure AD Connect such as Single Sign-On, Password Hash Sync, Device Writeback, bsaically anything that I think might still be causing this issue.

But alas I am still stuck. It seems like I can't revert the changes and go back to how things were where my users could change their own passwords on their PC's or via Office 365.

Now the only way it can be done is when logged in to the local AD as an admin or via the Office 365 admin portal as an admin.

Appreciate any help, I am completely stuck!

Best Answer

This has nothing to do with password writeback.

Azure AD Connect shouldn't prevent users from changing their on premises password. How do the users log onto their computers? Are they using their Office 365 username? Are these computers Hybrid Azure AD joined?

See the links below for disabling/removing directory synchronization.

https://docs.microsoft.com/en-us/microsoft-365/enterprise/turn-off-directory-synchronization?view=o365-worldwide

https://interworks.com/blog/mroy/2018/07/25/how-to-fully-remove-microsoft-azure-ad-connect/