Update-MgUser -PasswordPolicies DisablePasswordExpiration: password never expires

Update-MgUser -UserId ID -PasswordPolicies "DisablePasswordExpiration" makes a Microsoft Entra ID user's password never expire, regardless of the tenant's expiration policy. It writes the passwordPolicies property of the user, which the Graph user resource defines as: "Specifies password policies for the user. This value is an enumeration with one possible value being DisableStrongPassword, which allows weaker passwords than the default policy to be specified. DisablePasswordExpiration can also be specified. The two might be specified together; for example: DisablePasswordExpiration, DisableStrongPassword." It replaces Set-MsolUser -PasswordNeverExpires $true from the retired MSOnline module.

Connect-MgGraph -Scopes "User.ReadWrite.All"
Update-MgUser -UserId svc-scanner@contoso.com -PasswordPolicies "DisablePasswordExpiration"
Get-MgUser -UserId svc-scanner@contoso.com -Property UserPrincipalName, PasswordPolicies |
  Select-Object UserPrincipalName, PasswordPolicies

Values

The value is one string, not an array. Setting DisablePasswordExpiration alone removes DisableStrongPassword if it was set, so read the current value first and write the combination you want.

The parameter in the module

Checked offline in Windows PowerShell 5.1 with Microsoft.Graph.Users 2.41.2: the parameter is a plain string, also available on New-MgUser, and the cmdlet needs a Graph session.

Import-Module Microsoft.Graph.Users
foreach ($cmd in 'Update-MgUser', 'New-MgUser') {
  $p = (Get-Command $cmd).Parameters['PasswordPolicies']
  '{0} -PasswordPolicies: {1}' -f $cmd, $p.ParameterType.Name
}
try { Update-MgUser -UserId svc-scanner@contoso.com -PasswordPolicies "DisablePasswordExpiration" -ErrorAction Stop } catch { $_.Exception.Message }

Update-MgUser -PasswordPolicies: String
New-MgUser -PasswordPolicies: String
Authentication needed. Please call Connect-MgGraph.

Because nothing validates the text locally, a typo is sent to Graph as is and rejected by the service.

Reading the value

passwordPolicies "Requires $select to retrieve", so Get-MgUser shows it empty unless you add -Property PasswordPolicies (Get-MgUser -Property). To list every user with a non-expiring password:

Get-MgUser -All -Property UserPrincipalName, PasswordPolicies |
  Where-Object PasswordPolicies -like '*DisablePasswordExpiration*' |
  Select-Object UserPrincipalName, PasswordPolicies

Pitfalls

• Security trade-off. Microsoft's current guidance favours non-expiring passwords combined with MFA for people; for service accounts, prefer managed identities or app registrations with certificates over user accounts with static passwords.
• Turning expiration back on. Microsoft warns that passwords set to never expire still age by LastPasswordChangeDateTime: after -PasswordPolicies None, every password older than 90 days must be changed at the next sign-in, which can hit many users at once.
• Tenant-wide setting. To stop expiration for everyone, change the organization's password expiration policy in the Microsoft 365 admin center instead of setting each user.
• Permissions. A Graph scope alone is not enough when the signed-in admin lacks a suitable Entra role; see Graph permission vs Entra role.
• Resetting passwords is a different operation (reset a user password).

FAQ