How to Send Email Notifications Before Microsoft 365 Password Expiry
Question details
The user wants to configure the system to send email notifications to users before their account passwords expire, rather than relying on the standard 14-day system prompt.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Administrators managing user accounts and password expiration policies for a Microsoft 365 organization.
- Observed behavior
- Microsoft 365 displays a password-expiry notification 14 days before expiration during sign-in, but fails to send an automated warning by email.
Ensure you have global administrator privileges in your Microsoft 365 tenant and a basic understanding of executing PowerShell scripts for administrative tasks.
Use a Custom PowerShell Script to Automate Expiry Notifications
Since Microsoft 365 lacks a native toggle for password-expiry email alerts, administrators must deploy a PowerShell script to query expiration dates and dispatch customized emails.
Microsoft designed its systems to show expiration prompts directly on the login screen or desktop applications to minimize phishing risks. Consequently, there is no built-in administrative setting to enable email notifications for password expiry.
To achieve this, you must rely on a custom PowerShell script. The script connects to your directory, retrieves user password expiration dates, identifies which users are within the warning window (e.g., 14 days), and sends an automated warning email.
Open PowerShell as an administrator and connect to your Microsoft 365 tenant using the Microsoft Graph PowerShell module or the MSOnline module (e.g., Run 'Connect-MgGraph').
Use the appropriate cmdlet (such as 'Get-MgUser') to fetch all active users and retrieve the 'PasswordPolicies' and last password change timestamps to calculate when each password expires.
Add a condition in your script to filter out users whose calculated expiration date falls exactly within your desired threshold, such as 14, 7, or 3 days from the current date.
Use the 'Send-MailMessage' cmdlet or the Microsoft Graph API to format an automated email. Include clear instructions for the user on how to safely reset their password.
Set up a recurring task using Windows Task Scheduler on a local server, or use Azure Automation to run the PowerShell script daily.
Experience a Free and Lightweight Alternative to Microsoft Office
While managing complex enterprise settings like password expiry notifications in Microsoft 365 can be cumbersome, providing your team with efficient office software doesn't have to be. Consider WPS Office as a free, lightweight, and highly compatible alternative that reduces administrative overhead.
- 1. Download WPS Office: Visit the official WPS website to download the free installation package for your operating system.
- 2. Install and launch the suite: Run the installer and open WPS Office to access Writer, Spreadsheet, and Presentation tools in one unified interface.
- 3. Open existing Office files: Drag and drop your existing .docx, .xlsx, or .pptx files directly into WPS Office to continue your work seamlessly.
Frequently Asked Questions
Why doesn't Microsoft 365 send password expiry emails by default?
Microsoft designed the system to prompt users during the sign-in process rather than via email. This approach helps protect organizations from phishing attempts, as malicious actors frequently use fake 'password expiration' emails to steal credentials.
Can I use Azure Automation to run the password expiry PowerShell script?
Yes, using Azure Automation Runbooks is a highly recommended method for running these scripts. It eliminates the need to maintain an always-on, on-premises server specifically for Windows Task Scheduler.
Are there third-party tools that can send Microsoft 365 password expiry emails?
Yes, several third-party Active Directory and Microsoft 365 management tools offer built-in, GUI-based password expiration email notifications. This is a great alternative if you prefer not to manage and maintain custom PowerShell scripts.
