Free Password Expiration Notification with Follow-up Emails in Power Automate

Statistics show that password-related issues are among the most common helpdesk calls💻📞. Implementing an automated process to get password expiration notification email can significantly reduce helpdesk call volume and associated costs. In our previous blog, we discussed how to create password change reminders using Power Automate . One of the most requested solutions for password expiration management is sending follow-up emails✉. In this blog, we’ll show you how to set up free password expiry notification with 7-day follow-up emails, so your users never miss a deadline.

By default, Microsoft 365 passwords are set to never expire, a recommendation by Microsoft to reduce user burden and prevent risks associated with frequent password changes, such as weaker or reused passwords. Despite Microsoft’s recommendation, many organizations still choose to set Azure AD password expiration policy.

If your organization sets an expiration limit for user passwords, it’s crucial to establish a system to automate password expiry notifications in Microsoft 365. Manually managing this process can be challenging but automating it can save time and reduce the risk of forgotten password changes. While using PowerShell scripts is also an option, using an automated password expiry notification tool allows for more granular customizations.

Let’s see how to set up password expiry alerts with a free password expiration notifier using Power Automate.

Yes, this is a free password expiry notification tool because it uses standard connectors instead of premium ones. This means you don’t need a Power Automate premium license, allowing you to run effective workflows without incurring extra costs. Additionally, Power Automate comes free with your Office 365 license, enabling you to leverage this free password expiration notifier without additional expenses.

To make this process easy for you, we’ve created a detailed step-by-step video guide. This video walks you through each step, ensuring you can follow along and set up email notifications for password expiration reminders correctly. Watch the video here:

Here is a breakdown of what exactly happens in each step of the flow:

1. Recurrence: This trigger runs the flow on a scheduled basis, such as daily, to ensure daily checks for expiring passwords.
2. Enter expiry limit: This step likely allows the admin to input the expiry limit (e.g., 90 days) for passwords.
3. Send an HTTP request: This step fetches user data, including LastPasswordChangeDateTime, PasswordPolicies, and userPrincipalName from Microsoft Graph API.
4. Parse JSON: Parses the response from the HTTP request into a JSON format that can be easily processed in the flow.
5. Filter empty and null values: Filters out any records where the relevant password change date or is empty or null.
6. Filter expiring items: Filters the data to include only those items (user accounts) that are within the password expiry limit set by the admin.
7. Filter never expires set items: Further excludes items (user accounts) where the password is set to never expire.
8. Initialize days remaining: Initializes a variable to store the days left until password expiry.
9. Process each expiring item: Loops through each filtered user item that has an expiring password.

Inside the Loop:

i) Calculate expiring date: Adds the expiry limit to the LastPasswordChangeDateTime to determine the expiry date.
ii) Calculate days remaining: Checks if a follow-up password expiry email notification should be sent based on the number of days remaining.
iii) Calculates ticks difference: Calculates the difference in ticks between the expiry date and the current date. (Ticks are a finer granularity of time measurement.)
iv)Convert difference in ticks to difference in days: Converts the ticks difference into days.

10. Store calculated difference in days: Stores the final calculated difference in days in the daysRemaining variable.
11. Switch: Evaluates the daysRemaining variable to determine the appropriate action (i.e., when to send Microsoft 365 password expiry notification).
12. Cases: A password expiration email notification is sent daily for up to 7 days until the user changes their password.
13. Default: No action is taken if daysRemaining does not match any of the cases (e.g., more than 7 days remaining or negative values).

At this point, you should have a good understanding of how the flow works. Next, let’s see the step-by-step procedure to deploy the flow and start sending email notification on password expiration for your Microsoft 365 users.

Let’s see how you can easily import our pre-built package into your Power Automate environment and run the flow that sends email notifications to users before password gets expired: Follow these steps to get started:

Download the PasswordExpirationNotificationFlow.zip

For more workflows on M365 user onboarding & offboarding, refer our AdminDroid GitHub.

• Open the Power Automate app.
• In the left navigation pane, select My flows.
• At the top, click the Import dropdown.
• Select Import package (legacy) from the dropdown.

• Once the page loads, click Upload. Choose the downloaded zip file.
• Wait for the file to finish uploading.

• Under Choose your import options, click Update. Select Create as new and click Save.

• Under Related resources, select Create new. This opens the connections page where you can add the necessary standard connectors for the flow.
• Click Create a connection and search for Office 365 Outlook. Click the + button to add the connection.
• Next, click Add connection, search for Office 365 Users, and add another connection.

Return to the configuration page. Click the Refresh list option, select the added account, and click Save for both connectors.

• Once the Import button is enabled, click it and wait for the package to import.

• After the package is successfully imported, select Open flow.

• This opens the imported flow in your Power Automate workspace. Navigate to the My flows page.
• Select the flow, click More options (three dots), and choose Turn on.

• Select the Edit button to open the flow for editing.
• In the second action, labeled Enter expiry limit, enter the expiration limit set for your organization. The default is 90 days.
• Click Save.

• Click on the Test option.
• Select Manually and then click Test.
• Click Run flow and then Done.
• Verify that the flow ran successfully and check that the users meeting the condition have received emails.

Once you save the flow, it will run daily, automatically sending notifications to users whose passwords are approaching expiration. And that’s it! Your flow to notify Microsoft 365 users about their upcoming password expiration is now ready to go! 🚀

Let’s check the password expiration email received for one of the users.

In the email body, they will be given a link to the password change portal as shown below. They can change the password right away.

Note: If you’d like to modify the content of the email, you can adjust the “Send an email” action within the flow and customize the email body to better suit your preferences.

We hope that this blog has helped you with the Power Automate flow that sends email notification for password expiration seven days in advance. Similarly, you can also use Power Automate to simplify Microsoft 365 onboarding & offboarding practices. Thanks for reading. If you have any questions or need further assistance, please leave a comment below.