Password & Account Recovery

How to Fix Entra ID Password Writeback Error 12004

Maira Mehtab Sep 22, 2026 869 views

Question details

Users are encountering error code 12004 during password resets, and the system appears to default to the old domain password.

Product: Microsoft Entra ID
Device & OS: not provided
Scenario: Resetting user passwords after synchronizing an on-premises Active Directory with Microsoft Entra ID.
Observed behavior: Password resets fail to synchronize properly, falling back to an old domain password while new password attempts consistently return error 12004.

Before you start

Ensure you have global administrator or hybrid identity administrator privileges in Microsoft Entra ID and administrative access to the server running Azure AD Connect.

Solution 1Recommended

Trigger Delta Synchronization and Verify Writeback Settings

Force an immediate synchronization cycle to ensure recent password changes and configurations are properly communicated between on-premises AD and Entra ID.

Synchronization timing issues are a primary cause of error 12004. Manually triggering a delta sync pushes pending updates through the Azure AD Connect pipeline immediately.

Open PowerShell

Log into the server hosting Azure AD Connect and launch Windows PowerShell with Administrator privileges.

Execute the Sync Command

Type 'Start-ADSyncSyncCycle -PolicyType Delta' and press Enter to initiate a manual delta synchronization.

Verify Password Writeback in AD Connect

Open the Azure AD Connect wizard, navigate to 'Optional Features', and confirm that the 'Password Writeback' checkbox is enabled.

Check Entra ID SSPR Settings

Log into the Microsoft Entra admin center, go to 'Password reset' > 'On-premises integration', and verify that password writeback is turned on.

Sync Completion: Wait a few minutes after running the command for the synchronization to fully propagate before testing the password reset again.

Solution 2

Review Conditional Access and Password Policies

Ensure that on-premises complexity requirements are met and that restrictive cloud security policies are not blocking the reset process.

Free Microsoft Office alternative

Manage IT Documentation Seamlessly with WPS Office

While resolving complex enterprise infrastructure issues like Entra ID writeback errors, having a reliable document editor for your IT guides and policies is essential. WPS Office provides a free, robust alternative to Microsoft Office, ensuring your workflow remains uninterrupted.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install the Software: Run the setup file and follow the quick on-screen instructions to install the suite on your computer.
3. Open Your Documents: Launch WPS Office to instantly open and edit your existing Microsoft Office IT documentation without format distortion.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight architecture ensures it consumes minimal system resources on IT administrative machines.Familiar tabbed user interface allows for a completely seamless migration with zero learning curve.Built-in PDF editing tools make generating, editing, and sharing IT infrastructure reports incredibly easy.

microsoft office alternative - wps office

Frequently Asked Questions

What is Password Writeback in Entra ID?

Password Writeback is a feature in Azure AD Connect that allows password changes, resets, and unlocks performed in the cloud to be written back to an on-premises Active Directory in real time.

Why am I receiving error 12004 during a password reset?

Error 12004 typically indicates a failure in the password writeback process. This can be caused by pending synchronization queues, the new password failing to meet on-premises complexity rules, or Conditional Access policies blocking the reset location.

How long does a manual delta sync take to complete?

A manual delta synchronization usually completes within a few minutes, though the exact time depends on the volume of object changes queued between your on-premises AD and Entra ID.

Where do I add trusted locations for Conditional Access?

You can add trusted IP ranges and countries by logging into the Microsoft Entra admin center, navigating to Security, selecting Conditional Access, and configuring the options under Named locations.

Login & Account Issues