diff --git a/model/model-common/src/main/java/com/evolveum/midpoint/model/common/stringpolicy/ValuePolicyProcessor.java b/model/model-common/src/main/java/com/evolveum/midpoint/model/common/stringpolicy/ValuePolicyProcessor.java
index e0b9a66eb2c..aff54adb35b 100644
--- a/model/model-common/src/main/java/com/evolveum/midpoint/model/common/stringpolicy/ValuePolicyProcessor.java
+++ b/model/model-common/src/main/java/com/evolveum/midpoint/model/common/stringpolicy/ValuePolicyProcessor.java
@@ -160,7 +160,7 @@ public <O extends ObjectType> String generate(ItemPath path, ValuePolicyType pol
 			}
 			LOGGER.trace("Generator attempt {}: check failed", attempt);
 			if (attempt == maxAttempts) {
-				ExpressionEvaluationException e =  new ExpressionEvaluationException("Unable to generate value, maximum number of attempts exceeded");
+				ExpressionEvaluationException e =  new ExpressionEvaluationException("Unable to generate value, maximum number of attempts ("+maxAttempts+") exceeded");
 				result.recordFatalError(e);
 				throw e;
 			}
diff --git a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/sync/TestImportRecon.java b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/sync/TestImportRecon.java
index 5abb05b2f6c..9694eb7c6eb 100644
--- a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/sync/TestImportRecon.java
+++ b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/sync/TestImportRecon.java
@@ -1550,6 +1550,7 @@ public void test320ReconcileDummyAzureDeleteOtis() throws Exception {
 	/**
 	 * Create account that will correlate to existing user.
 	 * See that it is linked and modified.
+	 * MID-4997
 	 */
 	@Test
     public void test330ReconcileDummyAzureAddAccountRapp() throws Exception {
@@ -1621,6 +1622,8 @@ public void test330ReconcileDummyAzureAddAccountRapp() throws Exception {
         }
 
         assertNotNull("No clear text password", stringPassword);
+        assertTrue("Rapp's password is supposed to contain letter a: "+stringPassword, stringPassword.contains("a"));
+
 
         PrismObject<ValuePolicyType> passwordPolicy = getObjectViaRepo(ValuePolicyType.class, PASSWORD_POLICY_LOWER_CASE_ALPHA_AZURE_OID);
 
diff --git a/model/model-intest/src/test/resources/sync/password-policy-azure.xml b/model/model-intest/src/test/resources/sync/password-policy-azure.xml
index 2b455dc8ef5..fa7858cec31 100644
--- a/model/model-intest/src/test/resources/sync/password-policy-azure.xml
+++ b/model/model-intest/src/test/resources/sync/password-policy-azure.xml
@@ -60,6 +60,14 @@
                <value>1234567890</value>
             </characterClass>
          </limit>
+       	<checkExpression>
+			<expression> <!-- MID-4997 -->
+				<script>
+					<code>return input.contains('a')</code>
+				</script>
+			</expression>
+		</checkExpression>
+		<maxAttempts>50</maxAttempts>
       </limitations>
    </stringPolicy>
 </valuePolicy>
\ No newline at end of file