How to Force Password Changes for All Users in Microsoft 365 Using PowerShell

First, you need to install the Microsoft Graph PowerShell SDK module, which replaces the deprecated MSOnline module. Open PowerShell as Administrator and run the installation command.

Install-Module Microsoft.Graph -Repository PSGallery -AllowClobber -Force

The installation might take several minutes as it downloads multiple sub-modules. If prompted about installing from an untrusted repository, type 'Y' to continue.

Get-Module Microsoft.Graph -ListAvailable | Select-Object Name, Version

You should see the Microsoft.Graph module listed with the current version number.

Establish a connection to Microsoft Graph with the necessary permissions to modify user password policies. The User.ReadWrite.All scope provides the required access to update user password settings.

Connect-MgGraph -Scopes "User.ReadWrite.All"

This command will open a browser window for authentication. Sign in with your Microsoft 365 administrator account and consent to the requested permissions.

Get-MgContext | Select-Object Account, Scopes

The output should show your authenticated account and the User.ReadWrite.All scope in the permissions list.

Before running bulk operations, test the process on a single user account. This helps verify your permissions and understand the process flow.

$UserPrincipalName = "testuser@yourdomain.com"
Update-MgUser -UserId $UserPrincipalName -PasswordProfile @{
    ForceChangePasswordNextSignIn = $true
}

Replace 'testuser@yourdomain.com' with the actual user's email address. This command sets the ForceChangePasswordNextSignIn flag to true, requiring the user to change their password at next login.

Get-MgUser -UserId $UserPrincipalName -Property "UserPrincipalName,PasswordProfile" |
Select-Object UserPrincipalName, @{Name="MustChangePassword";Expression={$_.PasswordProfile.ForceChangePasswordNextSignIn}}

The output should show 'True' in the MustChangePassword column, confirming the setting was applied successfully.

Before forcing password changes for all users, retrieve the complete user list and prepare your environment for bulk processing. This step helps you understand the scope of the operation.

$AllUsers = Get-MgUser -All -Property "UserPrincipalName,DisplayName,AccountEnabled"
$TotalUsers = $AllUsers.Count
Write-Host "Total users found: $TotalUsers" -ForegroundColor Cyan

This command retrieves all users with essential properties. The -All parameter ensures you get every user, not just the first 100 (default limit).

Filter active users only:

$ActiveUsers = $AllUsers | Where-Object {$_.AccountEnabled -eq $true}
Write-Host "Active users: $($ActiveUsers.Count)" -ForegroundColor Green

$ActiveUsers | Select-Object UserPrincipalName, DisplayName | Select-Object -First 5

Critical step: Create an exclusion list for administrative accounts to prevent locking yourself out of the system. This is essential for maintaining access during and after the password change operation.

# Define administrative accounts to exclude
$AdminAccounts = @(
    "admin@yourdomain.com",
    "globaladmin@yourdomain.com",
    "serviceaccount@yourdomain.com"
)

# Filter out administrative accounts
$UsersToUpdate = $ActiveUsers | Where-Object {
    $_.UserPrincipalName -notin $AdminAccounts
}

Write-Host "Users to update after exclusions: $($UsersToUpdate.Count)" -ForegroundColor Yellow
Write-Host "Excluded admin accounts: $($AdminAccounts.Count)" -ForegroundColor Red

Customize the $AdminAccounts array with your organization's administrative account email addresses. This prevents accidentally forcing password changes on critical service accounts.

Write-Host "Excluded accounts:" -ForegroundColor Red
$AdminAccounts | ForEach-Object { Write-Host "  - $_" -ForegroundColor Red }

Now execute the bulk password change operation with comprehensive error handling and progress tracking. This script processes each user individually and provides detailed feedback.

# Initialize counters
$SuccessCount = 0
$ErrorCount = 0
$ProcessedCount = 0
$TotalToProcess = $UsersToUpdate.Count

# Process each user with error handling
ForEach ($User in $UsersToUpdate) {
    try {
        Update-MgUser -UserId $User.UserPrincipalName -PasswordProfile @{
            ForceChangePasswordNextSignIn = $true
        }
        $SuccessCount++
        Write-Host "✓ Successfully updated: $($User.UserPrincipalName)" -ForegroundColor Green
    }
    catch {
        $ErrorCount++
        Write-Host "✗ Failed to update $($User.UserPrincipalName): $($_.Exception.Message)" -ForegroundColor Red
    }
    
    $ProcessedCount++
    $PercentComplete = [math]::Round(($ProcessedCount / $TotalToProcess) * 100, 2)
    Write-Progress -Activity "Forcing Password Changes" -Status "Processing $($User.UserPrincipalName)" -PercentComplete $PercentComplete
    
    # Add small delay to avoid throttling
    Start-Sleep -Milliseconds 500
}

Write-Host "`nOperation completed:" -ForegroundColor Cyan
Write-Host "  Success: $SuccessCount" -ForegroundColor Green
Write-Host "  Errors: $ErrorCount" -ForegroundColor Red
Write-Host "  Total Processed: $ProcessedCount" -ForegroundColor Cyan

$SampleUsers = $UsersToUpdate | Get-Random -Count 3
$SampleUsers | ForEach-Object {
    $User = Get-MgUser -UserId $_.UserPrincipalName -Property "UserPrincipalName,PasswordProfile"
    [PSCustomObject]@{
        UserPrincipalName = $User.UserPrincipalName
        MustChangePassword = $User.PasswordProfile.ForceChangePasswordNextSignIn
    }
}

For enhanced security, you can force password changes while simultaneously assigning temporary passwords. This ensures users get new credentials immediately and must change them at next login.

# Function to generate secure temporary passwords
function New-TempPassword {
    param([int]$Length = 12)
    $Characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*'
    $Password = -join ((1..$Length) | ForEach {$Characters[(Get-Random -Maximum $Characters.Length)]})
    return $Password
}

# Array to store results
$PasswordResults = @()

# Process users with temporary password assignment
ForEach ($User in $UsersToUpdate) {
    try {
        $TempPassword = New-TempPassword
        Update-MgUser -UserId $User.UserPrincipalName -PasswordProfile @{
            Password = $TempPassword
            ForceChangePasswordNextSignIn = $true
        }
        
        $PasswordResults += [PSCustomObject]@{
            UserPrincipalName = $User.UserPrincipalName
            DisplayName = $User.DisplayName
            TempPassword = $TempPassword
            Status = "Success"
            Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
        }
        
        Write-Host "✓ Password updated for: $($User.UserPrincipalName)" -ForegroundColor Green
    }
    catch {
        $PasswordResults += [PSCustomObject]@{
            UserPrincipalName = $User.UserPrincipalName
            DisplayName = $User.DisplayName
            TempPassword = "N/A"
            Status = "Failed: $($_.Exception.Message)"
            Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
        }
        Write-Host "✗ Failed to update password for $($User.UserPrincipalName)" -ForegroundColor Red
    }
    
    Start-Sleep -Milliseconds 500
}

Export results to CSV:

$ExportPath = "C:\Temp\PasswordReset-$(Get-Date -Format 'yyyyMMdd-HHmmss').csv"
$PasswordResults | Export-Csv -Path $ExportPath -NoTypeInformation
Write-Host "Results exported to: $ExportPath" -ForegroundColor Cyan

For targeted password changes, you can process specific users from a CSV file. This approach is useful when you need to force password changes for specific departments, groups, or security incidents.

First, create a CSV file with the following structure:

UserPrincipalName,DisplayName,Department
user1@yourdomain.com,John Doe,IT
user2@yourdomain.com,Jane Smith,HR
user3@yourdomain.com,Bob Johnson,Finance

Save this as 'users.csv' in C:\Temp\ directory. Then process the users:

# Import users from CSV
$CSVPath = "C:\Temp\users.csv"
if (Test-Path $CSVPath) {
    $UsersFromCSV = Import-Csv $CSVPath
    Write-Host "Imported $($UsersFromCSV.Count) users from CSV" -ForegroundColor Cyan
    
    # Process each user from CSV
    $CSVResults = @()
    $UsersFromCSV | ForEach-Object {
        try {
            Update-MgUser -UserId $_.UserPrincipalName -PasswordProfile @{
                ForceChangePasswordNextSignIn = $true
            }
            
            $CSVResults += [PSCustomObject]@{
                UserPrincipalName = $_.UserPrincipalName
                DisplayName = $_.DisplayName
                Department = $_.Department
                Status = "Success"
                ProcessedTime = Get-Date
            }
            
            Write-Host "✓ Updated: $($_.UserPrincipalName)" -ForegroundColor Green
        }
        catch {
            $CSVResults += [PSCustomObject]@{
                UserPrincipalName = $_.UserPrincipalName
                DisplayName = $_.DisplayName
                Department = $_.Department
                Status = "Failed: $($_.Exception.Message)"
                ProcessedTime = Get-Date
            }
            Write-Host "✗ Failed: $($_.UserPrincipalName)" -ForegroundColor Red
        }
        
        Start-Sleep -Milliseconds 300
    }
    
    # Display summary
    $SuccessfulCSV = ($CSVResults | Where-Object {$_.Status -eq "Success"}).Count
    $FailedCSV = ($CSVResults | Where-Object {$_.Status -ne "Success"}).Count
    
    Write-Host "`nCSV Processing Summary:" -ForegroundColor Cyan
    Write-Host "  Successful: $SuccessfulCSV" -ForegroundColor Green
    Write-Host "  Failed: $FailedCSV" -ForegroundColor Red
}
else {
    Write-Host "CSV file not found at $CSVPath" -ForegroundColor Red
}

$CSVResults | Export-Csv -Path "C:\Temp\CSV-PasswordReset-Results-$(Get-Date -Format 'yyyyMMdd-HHmmss').csv" -NoTypeInformation

After completing the password change operations, verify the results and generate comprehensive reports for documentation and compliance purposes.

# Verify password change requirements for all processed users
$VerificationResults = @()

Write-Host "Verifying password change requirements..." -ForegroundColor Cyan

$UsersToUpdate | ForEach-Object {
    try {
        $UserDetails = Get-MgUser -UserId $_.UserPrincipalName -Property "UserPrincipalName,DisplayName,PasswordProfile,LastPasswordChangeDateTime"
        
        $VerificationResults += [PSCustomObject]@{
            UserPrincipalName = $UserDetails.UserPrincipalName
            DisplayName = $UserDetails.DisplayName
            MustChangePassword = $UserDetails.PasswordProfile.ForceChangePasswordNextSignIn
            LastPasswordChange = $UserDetails.LastPasswordChangeDateTime
            VerificationTime = Get-Date
            Status = if ($UserDetails.PasswordProfile.ForceChangePasswordNextSignIn) { "Verified" } else { "Not Set" }
        }
    }
    catch {
        $VerificationResults += [PSCustomObject]@{
            UserPrincipalName = $_.UserPrincipalName
            DisplayName = "Unknown"
            MustChangePassword = "Error"
            LastPasswordChange = "Unknown"
            VerificationTime = Get-Date
            Status = "Verification Failed: $($_.Exception.Message)"
        }
    }
}

# Generate summary statistics
$TotalVerified = $VerificationResults.Count
$RequireChange = ($VerificationResults | Where-Object {$_.MustChangePassword -eq $true}).Count
$NotSet = ($VerificationResults | Where-Object {$_.MustChangePassword -eq $false}).Count
$Errors = ($VerificationResults | Where-Object {$_.Status -like "*Failed*"}).Count

Write-Host "`nVerification Summary:" -ForegroundColor Cyan
Write-Host "  Total Users Checked: $TotalVerified" -ForegroundColor White
Write-Host "  Require Password Change: $RequireChange" -ForegroundColor Green
Write-Host "  Not Set: $NotSet" -ForegroundColor Yellow
Write-Host "  Verification Errors: $Errors" -ForegroundColor Red

Generate comprehensive report:

# Export detailed verification report
$ReportPath = "C:\Temp\PasswordChange-VerificationReport-$(Get-Date -Format 'yyyyMMdd-HHmmss').csv"
$VerificationResults | Export-Csv -Path $ReportPath -NoTypeInformation

Write-Host "`nDetailed report exported to: $ReportPath" -ForegroundColor Cyan

# Display users who still don't require password change (potential issues)
$ProblematicUsers = $VerificationResults | Where-Object {$_.MustChangePassword -eq $false}
if ($ProblematicUsers.Count -gt 0) {
    Write-Host "`nUsers not requiring password change (review needed):" -ForegroundColor Yellow
    $ProblematicUsers | Select-Object UserPrincipalName, Status | Format-Table -AutoSize
}

Final verification command:

# Quick verification of random sample
Get-MgUser -All -Property "UserPrincipalName,PasswordProfile" | 
Where-Object {$_.PasswordProfile.ForceChangePasswordNextSignIn -eq $true} | 
Select-Object UserPrincipalName, @{Name="RequiresPasswordChange";Expression={$_.PasswordProfile.ForceChangePasswordNextSignIn}} | 
Select-Object -First 10