User must change password at next logon

[BartHermans007]

Hello,

If I set in Active Directory a new user with the flag "User must change password at next logon" then I get the message "Your password has expired. Type your updated password and try again". I do not have the possibility to change the password.

Yes, this is normal for ADFS, because the old password has never been entered and therefore does not exist. if the user connects with password / login ADFS will offer a form to change the password, if the user must change the password at the next login

If the password is not expired, I can login with user/password and TOTP token and afterwards change the password.

I have disabled the default ADFS change password possibility (/adfs/portal/updatepassword/) and the ADFSMFA CustomUpdatePassword is set to true. ADFSMFA "Password management" is enabled for the users.
So, I understand that when I disable the default "ADFS change password /adfs/portal/updatepassword/" the user can not change his password anymore when the setting "User must change password at next logon" is set for the user.

PS.: In the ADFSMFA Security Configuration windows, there's a Password Policy with a setting "Lock out the user if password has expired". But it doesn't make any difference to what I'm testing.

I also have a question about locking a user.
I'm using ADFS 2019 with ExtranetLockoutMode: ADFSSmartLockoutEnforce enabled.
This ADFS locking mechanism is based on the IP address of the client. After some bad logon attempts, the IP address is blocked for that user. What happens if a user authenticates with a good user account and password, but not with the a good TOTP several times? In the ADFSAccountActivity for the user I see no 'Familiar' lockout, so I assume that it is not used by ADFSMFA.

No, the mfa is not taken into account by ADFS concerning ExtranetLockOut.
For ADFSMFA, there is a maximum number of consecutive tries, a reduced period and an anti-replay system.
otherwise the user session is blocked
User login properties are never changed by ADFSMFA

Regards and thanks for the support.

[redhook62]

Mark it as answer.