We run a hybrid Microsoft environment where users are created in on-premises Active Directory and synchronized to Microsoft Entra ID. I want to create each user with "User must change password at next logon" enabled, which sets the relevant force-change attribute, and then deploy the account through Autopilot to an Entra-joined device. When the user enters their initial password during the first OOBE sign-in, will Windows immediately require them to choose a new password before setup can continue? We do not currently use self-service password reset, and the user's first sign-in can only happen during OOBE.
4 Answers
A cleaner modern onboarding flow is to avoid temporary-password changes during OOBE where possible. Issue a Temporary Access Pass, then have the user register Windows Hello for Business and the authenticator method. That avoids trying to force an old AD password-change workflow through the Entra-join experience.
Use a dedicated test account and run the complete process on a disposable device. Autopilot profile settings, authentication methods, password synchronization timing, and the Windows sign-in provider can all affect the result, so a lab test is more dependable than assuming the behavior from a standard domain-joined logon.
With password hash synchronization, selecting “User must change password at next logon” on a newly created on-premises account generally causes the synchronized cloud account to require a password change at its first password-based sign-in. The separate ForcePasswordChangeOnLogOn setting is mainly relevant to certain administrator-initiated password resets, not necessarily the initial synchronization of a new user.
The important distinction is where the sign-in happens. Entra authentication flows that accept a password can usually present the change-password prompt, but the standard Windows sign-in screen on an Entra-joined device does not reliably provide that experience for a temporary or expired password. Autopilot OOBE may therefore fail or leave the user unable to complete setup rather than simply showing a normal password-change page. Web sign-in can sometimes be used for this scenario, but it has significant limitations and should be tested carefully.
That approach is usually much smoother, but it requires the appropriate Entra authentication and Windows Hello for Business configuration to be in place first.