| description | ms.assetid | title | author | ms.author | manager | ms.date | ms.topic |
|---|---|---|---|---|---|---|---|
Learn more about: Configure AD FS to Send Password Expiry Claims |
03c82f43-ae2d-4038-b286-ae3858aed35a |
Configure AD FS to Send Password Expiry Claims |
billmath |
billmath |
amycolannino |
02/13/2024 |
article |
You can configure Active Directory Federation Services (AD FS) to send password expiry claims to the relying party trusts (applications) that are protected by AD FS. How these claims are used depends on the application. For example, with Office 365 as your relying party, updates have been implemented to Exchange and Outlook to notify federated users of their soon-to-be-expired passwords.
To configure AD FS to send password expiry claims to a relying party trust, you must add the following claim rules to this relying party trust:
@RuleName = "Issue Password Expiry Claims"
c1:[Type == "http://schemas.microsoft.com/ws/2012/01/passwordexpirationtime"]
=> issue(store = "_PasswordExpiryStore", types = ("http://schemas.microsoft.com/ws/2012/01/passwordexpirationtime", "http://schemas.microsoft.com/ws/2012/01/passwordexpirationdays", "http://schemas.microsoft.com/ws/2012/01/passwordchangeurl"), query = "{0};", param = c1.Value);
Note
Password expiry claims are only available for username and password and Windows Hello for Business authentication types. If the user authenticates using Windows integrated authentication and Passport is not configured, the claims will not be available and the users will not see password expiry notifications.
Note
There is a 14 days window so the sent claims will only be populated if the password is expiring within 14 days.