Skip to content

Get-AzADUser Does Not Return Password Policy #17839

Closed as not planned
Closed as not planned
Get-AzADUser Does Not Return Password Policy#17839
Assignees
VeryEarly
Labels
AADAzAd cmdlets in Az.Resourcesact-identity-squadbugThis issue requires a change to an existing behavior in the product in order to be resolved.customer-reported

Description

@devramdin
Dev Ramdin (devramdin)
opened on Apr 18, 2022

Description

Get-AzADUser does not return anything for PasswordPolicy.

Get-AzureADUser works as expected and returns PasswordPolicies.

Get-AzureADUser -ObjectId username@tenant.onmicrosoft.com | Select-Object PasswordPolicies

Issue script & Debug output

Get-AzADUser -ObjectId username@tenant.onmicrosoft.com | Select-Object PasswordPolicy

Environment data

Name                           Value                       
----                           -----                       
PSVersion                      7.2.2                       
PSEdition                      Core                        
GitCommitId                    7.2.2                       
OS                             Microsoft Windows 10.0.19044
Platform                       Win32NT                     
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}       
PSRemotingProtocolVersion      2.3                         
SerializationVersion           1.1.0.1                     
WSManStackVersion              3.0

Module versions

5.5.0

Error output

No response

Activity

  1. Dev Ramdin (devramdin)
    added
    bugThis issue requires a change to an existing behavior in the product in order to be resolved.
    needs-triageThis is a new issue that needs to be triaged to the appropriate team.
    on Apr 18, 2022
  2. ghost added
    customer-reported
    on Apr 18, 2022
  3. ghost removed
    needs-triageThis is a new issue that needs to be triaged to the appropriate team.
    on Apr 18, 2022
  4. Dingmeng Xue (dingmeng-xue)
    added
    AADAzAd cmdlets in Az.Resources
    on Apr 19, 2022
  5. Dingmeng Xue (dingmeng-xue)
    assigned
    Yabo Hu (VeryEarly)
    on Apr 19, 2022

  6. dingmeng-xue commented on Apr 19, 2022

    @dingmeng-xue
    Dingmeng Xue (dingmeng-xue)
    on Apr 19, 2022
    Member

    Thanks for reporting.

    Yabo Hu (@VeryEarly) , please help look into this question.

  7. VeryEarly commented on Apr 19, 2022

    @VeryEarly
    Yabo Hu (VeryEarly)
    on Apr 19, 2022
    Collaborator

    Hi Dev Ramdin (@devramdin)

    After trying following cmdlets

    Update-AzADUser -ObjectId XXXX -PasswordPolicy DisableStrongPassword
Get-AzADUser -ObjectId XXXX -debug
Body:
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
  "businessPhones": [],
  "displayName": "XXXXXXXX",
  "givenName": null,
  "jobTitle": null,
  "mail": null,
  "mobilePhone": null,
  "officeLocation": null,
  "preferredLanguage": null,
  "surname": null,
  "userPrincipalName": "XXXXXXXX",
  "id": "XXXX"
}

    As you can see the passwordpolicy is not in the response. The API used by Get-AzADUser is https://graph.microsoft.com/v1.0/users/{objectid}
    And the API used by Get-AzureADUser might be different.

  8. devramdin commented on Apr 19, 2022

    @devramdin
    Dev Ramdin (devramdin)
    on Apr 19, 2022
    Author

    Hi Yabo Hu (@VeryEarly),

    Thanks for your response. The Debug switch helped me troubleshoot the issue.

    The Graph API property name is PasswordPolicies but in Get-AzADUser it is PasswordPolicy.

    This doesn't work:
    Get-AzADUser -ObjectId XXXX -Select PasswordPolicies | Select-Object PasswordPolicies

    This does:
    Get-AzADUser -ObjectId XXXX -Select PasswordPolicies | Select-Object PasswordPolicy

    Is the inconsistency intentional? The property name is PasswordPolicies in Get-AzureADUser which I am trying to migrate away from.

  9. VeryEarly commented on Apr 25, 2022

    @VeryEarly
    Yabo Hu (VeryEarly)
    on Apr 25, 2022
    Collaborator

    -PasswordPolicy DisableStrongPassword

    Hi Dev Ramdin (@devramdin) ,

    Can you please share the response of

    Get-AzADUser -ObjectId XXXX -Select PasswordPolicies | Select-Object PasswordPolicy

    I tried run some tests but none of them have property "PasswordPolicies" or "PasswordPolicy"

  10. devramdin commented on Apr 25, 2022

    @devramdin
    Dev Ramdin (devramdin)
    on Apr 25, 2022
    Author

    Hi Yabo Hu (@VeryEarly),

    Get-AzureADUser doesn't have Select as a parameter. It returns all the attributes by default including PasswordPolicies.

  11. VeryEarly commented on May 20, 2022

    @VeryEarly
    Yabo Hu (VeryEarly)
    on May 20, 2022
    Collaborator

    Hi Yabo Hu (@VeryEarly),

    Get-AzureADUser doesn't have Select as a parameter. It returns all the attributes by default including PasswordPolicies.

    Sorry I didn't get your point, please share the response of whatever cmdlet you executed and successfully returned passwordpolicy

  12. Aditya Pujara (a0x1ab)
    added
    act-identity-squad
    on Apr 10, 2026

  13. microsoft-github-policy-service commented on Apr 10, 2026

    @microsoft-github-policy-service
    microsoft-github-policy-serviceBot
    on Apr 10, 2026 – with Microsoft GitHub Policy Service
    Contributor

    🔔 Routing this issue to @act-identity-squad.

  14. MaddyMicrosoft commented on Oct 8, 2026

    @MaddyMicrosoft
    MaddyMicrosoft
    on Oct 8, 2026
    Member

    To answer the open question: the naming is intentional. -Select takes the Graph name passwordPolicies, and the generated Az.Resources model surfaces it as the singular PasswordPolicy on the output object, which is a model convention, not a defect.
    The default-projection difference from the deprecated Get-AzureADUser is also expected, since Get-AzADUser follows Graph's default projection and needs -Select. The value is retrievable, so closing.
    If -Select PasswordPolicies stops surfacing it on a current release, please reopen with your module version and -Debug output.

  15. MaddyMicrosoft
    closed this as not plannedon Oct 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

AADAzAd cmdlets in Az.Resourcesact-identity-squadbugThis issue requires a change to an existing behavior in the product in order to be resolved.customer-reported

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions