Fix Microsoft 365 Password Reset Fails After Disabling Azure AD Connect Sync
Question details
The user is unable to reset passwords for Microsoft 365 accounts that were previously synchronized from an on-premises Active Directory because the Azure AD Connect disablement process has not yet completed.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Attempting to reset a Microsoft 365 user password shortly after disabling Azure AD Connect synchronization.
- Observed behavior
- The password reset operation fails because the directory synchronization status is still marked as 'PendingDisabled' instead of completely 'Disabled'.
Ensure you have global administrator privileges in your Microsoft 365 tenant and access to Microsoft 365 PowerShell. Note that directory synchronization changes can take up to 72 hours to propagate entirely.
Check Directory Synchronization Status via PowerShell
Use Microsoft 365 PowerShell to verify if the Azure AD Connect disablement process has fully completed before attempting to reset passwords.
When you disable Azure AD Connect, the transition is not instantaneous. User accounts remain locked in an on-premises synced state until the backend process completely changes the status from PendingDisabled to Disabled. You must confirm this status before making changes to accounts and groups.
Open PowerShell as an Administrator and connect to your Microsoft 365 environment using your administrative credentials.
Execute the command `(Get-MsolCompanyInformation).DirectorySynchronizationStatus` to check the current synchronization status.
If the command returns `PendingDisabled`, the disablement is still in progress and you must wait. If it returns `Disabled`, the process is complete.
Once the status successfully shows as `Disabled`, navigate to the Microsoft 365 admin center and try resetting the account password again.
Looking for a Lightweight Office Suite? Try WPS Office
While administrative backend tasks require specific Microsoft 365 tools, managing your daily documents, spreadsheets, and presentations shouldn't be complicated. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for your everyday productivity needs.
- 1. Download the Software: Visit the official WPS Office website and download the free installer designed for your operating system.
- 2. Install WPS Office: Run the downloaded installer file and follow the simple on-screen instructions to complete the setup process.
- 3. Open Your Documents: Launch WPS Office and directly open your existing Microsoft Office files to seamlessly continue your work without formatting loss.
Frequently Asked Questions
Why does Azure AD Connect take so long to disable?
Disabling directory synchronization requires Microsoft's backend to convert all previously synced user accounts, contacts, and groups into cloud-only objects. Depending on the number of objects in your tenant, this conversion can take anywhere from a few hours to 72 hours.
Can I speed up the PendingDisabled status in Microsoft 365?
No, there is no way to manually force or expedite the PendingDisabled status to complete. The process runs automatically on Microsoft's backend servers, and administrators simply must wait until the status returns as Disabled.
How do I know if an account is synced from on-premises Active Directory?
In the Microsoft 365 admin center, look at the 'Sync status' column under the Active users list. If an account shows an icon indicating it is synced from on-premises, its password cannot be reset in the cloud until directory sync is fully disabled.
What happens if I try to reset the password while the status is PendingDisabled?
The system will block the action and return a failure error because it still strictly treats the account as being managed by your on-premises Active Directory.
