Create temporary password for new user accounts in Office 365

Question

I have a business rule to create a user in our AD, and then have it create a new O365 account and assign it a license.

How can I have it create a temporary password that I specify during that business rule?

Comments

Hello,

For us to suggest a solution, please, post here or send us (support[at]adaxes.com) a screenshot of the Business Rule. Any additional details regarding the desired behavior would be much appreciated.

---

This is my current rule, after new user creation, adds the user to two security groups. Then as long as they're a user and NOT in those specificed OUs, it'll create an O365 account for them. I want to reset the AD password and the O365 password to one I specify after that.

Answer 1

Hello,

Thank you for the provided details. This can be done by enabling the Synchronize passwords option in the settings of your Microsoft 365 (former Office 365) tenant. As a result when a password is reset via Adaxes for an AD user that is included into the scope of the tenant, their password will be automatically changed in Microsoft 365. To enable the feature:

1. Launch Adaxes Administration Console.
2. In the Console Tree, expand your service node.
3. Navigate to Configuration\Cloud Services and select Office 365.
4. In the Result Pane on the right, select your tenant and click Edit.
5. On the Tenant Details tab, select the Synchronize passwords checkbox.
6. Click OK.

Comments

I know that this is an option, but I want the AD account and O365 accounts to have separate passwords.

---

Hello,

Thank you for clarifying. A user password in Microsoft 365 can be reset using a PowerShell script. Do you need the password to only be reset or also email/sent via SMS? How exactly are you specifying the template for the new password in the Reset password for the user action of your Business Rule?

---

We use a temporary password that they know for onboarding, so we want it to be set to that - no SMS or anything else necessary.

The reset password business rule is just the AD one, nothing to do with O365.

---

Hello,

Thank you for the provided details. You can use the below script in your Business Rule right after the Activate an Office 365 account action. In the script, the $newPassword variable specifies the password to be set. At first login users will need to change their password.

Import-Module MsOnline

$newPassword = "Temp!#$Pass" # TODO: modify me

# Get Office 365 Object ID
try
{
    $objectId = [Guid]$Context.TargetObject.Get("adm-O365ObjectId")
}
catch
{
    return # The user doesn't have an Office 365 account
}

# Get Office 365 Tenant credentials
$office365Cred = $Context.GetOffice365Credential()

# Connect to Office 365
Connect-MsolService -Credential $office365Cred

# Reset user password
Set-MsolUserPassword -ObjectId $objectId.ToString() -NewPassword $newPassword -ForceChangePassword $True

---

Awesome, thank you so much for the speedy responses! I will get this tested right away.

---

Works perfectly of course. Thank you very much.

Should I open another thread or can you point me to a script that allows me to add a user to an O365 group as well? (New user creation > add a user to O365 group)

---

Hello,

Works perfectly of course. Thank you very much.

Thank you for the confirmation, it is much appreciated.

Should I open another thread or can you point me to a script that allows me to add a user to an O365 group as well?

Depending on the type of groups to which a user should be added in Microsoft 365 (former Office 365), you can update the corresponding script from the following article in our repository to meet your needs: https://www.adaxes.com/script-repository/add-user-to-office-365-distribution-groups-based-on-business-unit-membership-s254.htm.

---

I'm looking through that, and for that, that's a script to run (if scheduled) to always add/remove people according to the OU in AD to a group in O365.

Is there anyway to modify that to just do the add portion when I'm creating a new user?

---

Hello,

Yes, it is possible. You will need to mark users in your Business Rule after assigning Microsoft 365 licenses (e.g. by setting a custom Boolean attribute to true) and use a Scheduled Task to run the script for adding users to groups. It cannot be done in the Business Rule itself as adding users to all groups except for security groups that are not enabled requires for users to be Exchange Online recipients. As such the Scheduled Task will look like the following: For us to provide you with the script to be executed in the task, please, specify to groups of which type users will be added.

---

It'll be Distribution and mail-enabled Security Groups

---

Hello,

Thank you for specifying. Have a look at the following script from our repository: https://www.adaxes.com/script-repository/add-user-to-distribution-and-mail-enabled-security-groups-in-microsoft-365-s578.htm.

---

Thank you again.

Sorry to bring the old issue up again, but initially when I setup the script it was working to change the domain to a different one in O365. But now it seems to not work during the creation phase, I have to run it after and it works fine. It's the "Update O365 Username to <domain> for the user"

My guess is that the account isn't fully created/"ready" to be used, and the business rules are going to quickly. Is there anyway to put logic in to say ok is the ready flag yes?, then proceed. If not, wait until flag says yes and then go.

Is that possible?

---

Hello,

As long as you are going to add users to Microsoft 365 groups in a Scheduled Task, you can move the script for the username update to the task. Finally, actions in the Business Rule and the Scheduled Task will look like the following:

Business Rule Scheduled Task