Send Microsoft 365 Password Expiration Notification Using Power Automate

Send M365 Password Expiration Notification via Power Automate

The online world is constantly evolving, and with it, the threats to your organization’s data. Securing your Microsoft 365 environment requires a multi-layered approach, but strong passwords remain the first line of defense🛡. For IT admins, managing these passwords effectively walks a tightrope between robust security and user convenience. Amid these challenges, it’s crucial to address the fundamental question: 

Do Passwords for Office 365 Expire? 

A common question among Office 365 users is, “Do passwords expire🤔?” The short answer is yes, and it depends on your organization’s settings. By default, passwords are set to never expire, which Microsoft recommends. This approach aims to reduce the burden on users and prevent the risks associated with frequent password changes, such as choosing weaker or reused passwords.  

Whether to set passwords to not expire or to set an expiry date for passwords has long been debated. Despite Microsoft’s recommendation, many organizations still opt to set password expiration policies.  

  • This decision is often driven by regulatory requirements, internal security policies, or a traditional belief that regular password changes enhance security.  

If your organization decides to set expiration dates, it is crucial to establish a system for tracking & reminding users about their upcoming password expirations. Automating this process can save time and reduce the risk of forgotten password changes. 

In this blog, we will explore how to send email notifications to users before the password expires using Power Automate. While PowerShell is also available for this task, Power Automate is preferred for more customizations. 

For more workflows on Microsoft 365 user onboarding & offboarding, refer our AdminDroid GitHub

How to Set Password Expiration Policy in Microsoft 365? 

Microsoft has pre-configured essential Azure AD password policies for secure implementation. However, admins can customize these settings to further strengthen organizational security. You can set expiration dates with these simple steps:  

  1. Go to the M365 admin center
  2. Navigate to Settings -> Org settings. 
  3. Under the ‘Security & privacy’ tab, locate ‘Password expiration policy’. 
  4. Uncheck ‘Set passwords to never expire’ and enter your desired value in the box. 
  5. You need to enter values between 14 and 730.
  6. Then Save. 

Once the password expiration policy is set, it’s the admin’s responsibility to ensure users are notified about upcoming expirations. This can be efficiently managed by creating a flow for password change reminders using Power Automate. For a user-friendly view of expiration details, use the Powershell script to track password expirations. 

Send Password Change Notification Using Power Automate

Here’s a step-by-step guide to create a Power Automate flow that sends password change notifications to users: 

License Requirements:

Since the HTTP action within the flow requires a premium license, you’ll need a Power Automate Premium license to run this flow without any errors or warnings. You can sign up for a 90-day free trial to test this functionality. 

Automated Password Change Notifications Workflow – An Overview 

Here’s how the flow works: 

  • Retrieves users’ password status from Microsoft Graph API. 
  • Checks for passwords that have not been changed for the given time period.
  • Sends an email to users reminding them to update their passwords. 

You have two methods to integrate the flow into your environment. Choose the one that best suits your requirements. 

1. Deploying Password Change Notification Flow Directly from a ZIP File 
2. Creating Password Change Notification Flow – A Step-by-Step Guide

Option 1: Deploying Password Change Notification Flow Directly from a ZIP File 

If you prefer not to build the flow from scratch, we’ve simplified the process for you. Just import our pre-built package into your Power Automate environment and effortlessly run the workflow. Follow these steps to get started: 

1. Importing the Flow: 

Download the PasswordChangeReminderEmail.zip 

  • In Power Automate, go to My Flows and click Import
  • Upload the ZIP file, modify the flow name as needed, and select Select during import
  • Authorize connections using your Office 365 account. 

2. Modifying the Flow: 

After importing successfully, make these necessary modifications: 

  • Within the HTTP action, add your access token value. 
Add access token value into HTTP header
Add access token value into HTTP header
  • Specify the desired time period to identify outdated passwords.
    • In the first field, choose the condition.
    • In the second field, input the function with the desired number of days. Example, (-60).

3. Enabling the Flow: 

  • Once modifications are complete, ensure the flow is turned on to initiate automated processes. 

Option 2: Creating Password Change Notification Flow – A Step-by-Step Guide 

If you prefer to create the flow manually, you can follow the below procedures. The flow includes, 

  1. Create a scheduled cloud flow 
  2. Add HTTP action 
  3. Parse JSON response 
  4. Add condition to check password change
  5. Send password change notification email 
  6. Save the flow

Step 1: Create a Scheduled Cloud Flow 

  • Open Power Automate and click on ‘Create’ from the left navigation. 
  • Under ‘Start from blank’, choose Scheduled cloud flow. A scheduled flow will allow you to run the process at specified intervals. 
  • Skip the recurrence action.
Password Expiration Notification flow using POWER AUTOMATE
Create a scheduled cloud flow in Power Automate

The next step is to add an HTTP action to fetch user data from Microsoft Graph API.

Step 2: Add HTTP Action 

  • To add the next action for your flow, click on the + button below Recurrence.
  • Select Add an action. Search for HTTP in the search box and select HTTP.  

The HTTP action allows you to make a request to an external API, in this case, Microsoft Graph, to fetch user data. 

Select HTTP action
Select HTTP action

Enter the following within the fields: 

  • URL:  
https://graph.microsoft.com/v1.0/users$select=userPrincipalName,lastPasswordChangeDateTime
  • Method: GET 
  • Headers: 
  • Key: Authorization 
  • Value: Bearer <access token> 

Replace <access token> with your access token. For example, Bearer eyJ0eXAi…… 

Configure parameters for HTTP action
Configure parameters for HTTP action

Note: An access token is necessary to authenticate the API request to Microsoft Graph. To generate an access token, first, register an app with Azure AD, add the necessary permissions (User.Read.All), and then use the credentials to generate one. 

Step 3: Parse JSON Response 

Parsing JSON allows you to easily handle the data returned from the HTTP request. For that,

  • Add an action and search for ‘Parse JSON’. 
Add an action - Parse JSON
Add an action – Parse JSON
  • In the ‘Content’ field, click on the dynamic content icon. It allows you to insert dynamic content from previous steps in your flow. 
Enter content and schema for Parse JSON
Enter content and schema for Parse JSON
  • Select ‘Body’ under ‘HTTP’. 
Add dynamic content value from HTTP
Add dynamic content value from HTTP
  • In the ‘Schema’ field, copy and paste the code below.  
{ 
    "type": "object", 
     "properties": { 
        "value": { 
            "type": "array", 
            "items": { 
                "type": "object", 
                "properties": { 
                    "userPrincipalName": { 
                        "type": "string" 
                    }, 
                    "lastPasswordChangeDateTime": { 
                        "type": "string" 
                    } 
                }, 
                "required": [ 
                    "userPrincipalName", 
                    "lastPasswordChangeDateTime" 
                ] 
            } 
        } 
    } 
}

The schema defines the structure of the JSON data you expect to receive. It acts as a blueprint that tells the automation tool how to parse and understand the JSON data. This schema ensures that the value property is an array of objects, where each object must contain a userPrincipalName and lastPasswordChangeDateTime, both as strings. This is used to process lists of users and their associated metadata, such as password change dates, within the workflow. 


Insert code into JSON schema
Insert code into JSON schema

Step 4: Add Condition to Check Password Change 

Now that we’ve processed the data, our next step is to verify the password change dates for each user. Proceed with the following steps for evaluation.  

  • The next action should be ‘Condition’. This checks when the password was last changed. Search for Condition and select it. 
Add Conditon acton to check password expiry
Add Conditon acton to check password expiry
  • In the ‘Choose a value’ field, click on the dynamic content icon and select Body LastPasswordChangeDateandTime. 
Add dynamic content value
Add dynamic content value
  • In the second field, select “is less or equal to”. 
  • In the third field, enter this value “addDays(utcNow(), -60)”

By default, this condition checks for users with a password age of 60 days or more and sends them reminder emails. You can adjust the value to notify users with older passwords based on your specific requirements.

Condition action to check last password change

Step 5: Send Password Change Notification Email: 

Next, we’ll configure it to send reminders to users informing them that their password is due for an update.

  • Click on the + inside the True condition -> Add an action. 
Configure email reminders
Configure email reminders
  • Search for Send an email(V2) under Office 365 Outlook. 
Select Office 365 Outlook
Select Office 365 Outlook
  • In the ‘To’ field, select ‘Enter custom value’, click on the dynamic content icon & select Body userPrincipalName. 
Add dynamic content value from Parse JSON
Add dynamic content value from Parse JSON

In the ‘Subject’ field, enter your subject – something like,

“Reminder: Your Password Needs to Be Changed”. 

  • In the ‘Body‘ field, enter the message – something like,  

“This is a reminder that your password is older and needs to be changed. Please update your password to ensure uninterrupted access to your account. Don’t wait until the last minute! Click here to change your password now”.

  • In the ‘Change connection’, you can add the email address from which the emails should be sent to users.

Step 6: Save the Flow 

Save your flow. Now your flow is ready to go and should look like the screenshot below. 

Flow Elements Breakdown: 

  • HTTP: Performs an HTTP request to get data from Microsoft Graph API. 
  • Parse JSON: Parses the JSON response from the HTTP request to make the data usable in subsequent steps. 
  • For each: Nested action that iterates over items within each iteration of the outer loop (likely a nested array). 
  • Condition: Checks a condition within each iteration. 
  • True: If the condition is met, sends an email using the “Send an email (V2)” action. 
  • False: If the condition is not met, no action is specified in the False branch. 

Testing the Password Change Notification Flow: 

  • After saving it, click ‘Test’ on the toolbar. 
  • In the Test Flow flyout page that appears, select ‘Manually’. 
  • Click on Test -> Run flow -> Done. 

When the admin manually triggers the flow, an email will be sent only to those users whose passwords have not been changed within the specified period.

We hope that this blog has given you detailed instructions to send password change notification emails in Microsoft 365.

We are currently working on a flow that runs daily to check for upcoming password expirations. Stay tuned for our follow-up blog on this🙌.

Further, those who have passwords set to never expire, consider strengthening your account security with options like passwordless authentication, Microsoft 365 passkeys, Microsoft Defender alerts, etc based on your requirements. Thanks for reading. For further queries, reach out to us in the comments section. 

Send M365 Password Expiration Notification via Power Automate

time to read: 8 min
Follow us!