Active Directory AccountExpires attribute does not stop login to Office 365
We discovered a security flaw in Office 365 whereby if you set an account in Active Directory to expired, the user can still login to Office 365.
We believe this is a major security flaw as many customers will believe if the user can no longer log in to the Active Directory domain then they must also not be able to login to Office 365, however this is not the case.
Setting an account with an expiry date should stop the account from logging into Office 365 as well.
Darren Hurst
shared this idea
33 comments
-
Anonymous
commented
Es importante que se tenga la solución para que se pueda expirar de manera simultanea en AD y en office
-
Anonymous
commented
It appears that this is under investigation not sure about the progress.
PLANNED ·
Azure AD Team (Admin, Microsoft Azure) responded · Aug 15, 2019
We are currently investigating how to implement this. The expiration status is not a directory attribute so it is not straight forward how to sync it. -
Nick Assar
commented
It's bad enough that anyone can "Azure AD register" their system for a 90-day loginless experience, but add this issue to that and its a recipe for the worst security implementation ever designed. It's shameful this issue persists for 3+ years with no comments from MS.
-
Anonymous
commented
Este ajuste debe hacerse. Es un atributo importante en el Directorio Activo.
-
Dan M
commented
Consider switching to PTA or running an automation job to set the account as disabled. When you expire accounts, you could also move them into a non-sync'd OU in AD.
-
D Olander
commented
Major security issue. Please fix asap.
-
mikie swier
commented
Major security issue. Please fix asap.
-
Anthony L.
commented
For such a major security flaw it is unacceptable to have a workaround solution. This needs to be resolved at a platform level ASAP.
-
Dylan Skeels
commented
HUGE security flaw, we use this in our district for various things and to find out it doesn't actually lock users out of 365 is just horrible. Please fix ASAP!
-
Graham C.
commented
This is achieved through federation.
-
C.M.Ramos
commented
Like the broken HideFromAddressLists attribute sync, this is a fundamental security item that should have been fixed in the builtin Sync Rules for AD Connect. Too many Disprovisioning processes and workflows are built around whether an account is Disabled that should not apply to an Expired Account that may or may not been an innocent lapse in the accounts renewal/extension approval, but the Account should immediately cease to function across all platforms until the Expiration is extended or the account truly Disabled. Please make this fix a priority.
-
Anon I Mouse
commented
Its August 2020 and this is a major security flaw, plain and simple. And to have it on going since dirsync was first created to syncronize on-prem AD to Azure AD is staggering. MS will say this is mitigated through other security meaures and conditional access rules. That may be true for customers that are able to afford those types of licenses. This is a foundational issue that should not be acceptable at all. Get on the ball, Microsoft - fix this permanently.
-
Anonymous
commented
Hello, today is July 30, 2020, and this compliance issue still exists. This issue has been open for 1301 DAYS! This can't be that hard to address. It's just another property field that the sync tools need to compare and update. For those of us in regulated industries, this could lead to millions of dollars worth of fines.
-
Clive
commented
This needs to be addressed so that it does not require tinkering with scripts to solve.
-
Evan Nichols
commented
I solved this problem with a Sync Rule expression referencing an extensionAttribute we are populating with MIM.
We're using extensionAttribute5 to mark "Enabled" or "Disabled" based on whether they are disabled or expired.IIF(BitAnd([userAccountControl],2)=2,False,IIF(IsPresent([extensionAttribute5]),IIF([extensionAttribute5]="Enabled",True,False),True))
-
Federico Rossi
commented
Hi, I've solved this with Azure AD Pass Through Authentication, the client will be authenticated directly against your on premises infrastructure: https://samcogan.com/azure-ad-connect-and-the-trouble-with-expired-passwords/
-
Jason Richardson
commented
This is an unbelievable security flaw. I would say I was shocked when I saw it, but...
-
Steven Fletchall
commented
I keep hearing people say it's a feature or intentional. Sounds like a flaw to me.
-
Nagappan Veerappan
commented
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization#account-expiration
==============
Account expirationIf your organization uses the accountExpires attribute as part of user account management, this attribute is not synchronized to Azure AD. As a result, an expired Active Directory account in an environment configured for password hash synchronization will still be active in Azure AD. We recommend that if the account is expired, a workflow action should trigger a PowerShell script that disables the user's Azure AD account (use the Set-AzureADUser cmdlet). Conversely, when the account is turned on, the Azure AD instance should be turned on.
=====================
-
Mark Joseph
commented
Office 365 Group, Do we have any other alternative on this concern? aside for manually running a script to disable account from local AD? or setup a auto schedule script to disable account?