Automatically Notify Microsoft 365 Users of Upcoming Password Expiration Using PowerShell & Azure Automation

Ensuring your Microsoft 365 users are aware of password expiration is critical for both security and productivity. Without proper notification, users can get locked out unexpectedly, causing support overhead and frustration. While Microsoft 365 doesn't send these notifications by default, we can fix that.

In this guide, you'll learn how to automate password expiration checks and send timely email alerts using:

• PowerShell

• Microsoft Graph API

• Azure Automation (or local execution)

📊 What This Script Does

• Connects to Microsoft Graph using App Registration

• Retrieves users from a dynamic Microsoft 365 group

• Checks their last password change date

• Calculates days until expiration (based on org policy)

• Sends custom email notifications for users whose passwords will expire soon (e.g., within 7 days)

💡 Note: The script assumes all users in the dynamic group have passwords that do expire (e.g., users logging in via Microsoft Entra ID Join). Therefore, it does not need to filter out accounts with PasswordNeverExpires, since the group logic already excludes them.

📄 Pre-Requisites

1. App Registration in Entra ID

• Create an app in Entra ID > App Registrations

• Assign API Permissions:

  • User.Read.All

  • Group.Read.All

  • Mail.Send

• Grant Admin Consent

• Generate a client secret and note the Application (Client) ID and Directory (Tenant) ID

2. Licensed Sender Mailbox

Ensure your app is authorized to send mail on behalf of a licensed user, such as noreply@yourdomain.com.

3. Optional: Azure Automation Setup

Store sensitive variables as Automation Variables:

• ClientID

• ClientSecret

• TenantID

• GroupId

• SenderEmail

• PasswordExpirationDays

---

💡 Features of the Script

• Can run locally or inside Azure Automation

• Smart logging via Write-Log (supports verbosity and silent automation)

• UPN masking for privacy in logs

• Error handling and graceful exits

---

👺 Masked Logging Example

User: jo*****@domain.com | Days remaining: 5
Sending alert...
Email sent to jo*****@domain.com

---

✎ Script Usage (Locally or in Azure)

⚡ Local Test Example:

.\Notify-M365PasswordExpiry.ps1 `
    -ClientId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" `
    -ClientSecret "your-secret" `
    -TenantId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" `
    -GroupId "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" `
    -PasswordExpirationDays 45 `
    -SenderEmail "noreply@yourdomain.com" `
    -UseLocalParameters

🚀 Scheduled in Azure Automation:

• Import the script as a Runbook

• Set up a daily schedule

• Securely store secrets using Automation Variables

---

🔧 Under the Hood (Logic Breakdown)

1. Get access token using client_credentials

2. Connect to Microsoft Graph

3. Fetch users from the target group

4. For each user:

   • Get LastPasswordChangeDateTime

   • Add org-defined expiration window (e.g., 45 days)

   • Calculate remaining days

   • If within 7 days, send email

🧩 Key Functions Explained

🔐 Get-GraphAccessToken

Authenticates using client credentials and retrieves a Microsoft Graph API access token.

🌐 Connect-ToGraph

Uses the Microsoft Graph PowerShell SDK to establish a session for additional operations like retrieving user data.

👥 Get-GroupUsers

Fetches members from the specified dynamic group by Group ID.

🔍 Get-UserDetails

Retrieves DisplayName, UserPrincipalName, and LastPasswordChangeDateTime for each user.

✉ Send-EmailNotification

Sends a formatted HTML email to users using Microsoft Graph's sendMail endpoint. The message content is fully customizable based on your organization’s communication style.

---

🔗 GitHub Repository

You can find the full script and future updates here: 🔗 GitHub – Notify-M365PasswordExpiry.ps1

---

📈 Benefits

• Reduces help desk tickets

• Keeps users informed and proactive

• Flexible: can run in the cloud or on-prem

• Secure: supports masked logging and stored secrets

---

🌐 What You Can Improve Next

• Integrate Microsoft Teams alerts

• Write logs to Azure Storage or Log Analytics

• Localize email messages based on user locale (optional – currently defaulted to English)

---

🚀 Final Thoughts

This script gives you full control over Microsoft 365 password expiration reminders, with enterprise-grade flexibility. Whether you run it in Azure Automation or locally, it's ready to scale and secure.

Have questions or want enhancements? Let's build on this together! ✨