Take away the possibility for users in Exchange Online to change their own password
Got a question today if it is possible to prevent a user from changing his or her own password when using Exchange Online, within Office 365.
The answer is Yes 
And how to do this? Find one way of doing this in this blog post, using (what did you expect?) the magic of PowerShell.
Setting the scene
I want to create a new user id, called Test, in my Office 365 environment, and have the following password characteristics:
- Password should never expire
- Password should not need to be changed at first logon of the user
- Password can not be changed by the user, using OWA.
Step 1. Create the user
Using the Office 365 admin portal, I’m creating my new user:
Step 2. Changing Password Settings
I do not want my user to sign in with that temporary password, so by using the Microsoft Online Service Module for Windows PowerShell, I change the password to the one I want, and I set it to never expire, and I disable the fact that the user will need to change the password at the first logon.
To set the password to never expire, I’m using the cmdlet Set-MsOlUser and adding PasswordNeverExpires, and setting it to $True.
To set the password to a predefined value, I use the cmdlet Set-MsOlUserPassword, and add the new password using NewPassword (be aware, you need to identify the password in clear text here, no need to encrypt it first), and then by adding the ForceChangePassword and setting it to $False, the user won’t be prompted to change it after his first login!
Signing in, the user needs to enter his password I have given the user, and can sign in:
But the user is still able to go to OWA, select Options, and from there change his password.
When searching the web, it is possible in an Exchange On Premises environment to disable the Change your password functionality from within OWA/ECP:
- http://technet.microsoft.com/en-us/library/bb684904
- http://technet.microsoft.com/en-us/library/bb123962.aspx
But the cmdlet Set-OwaVirtualDirectory and its parameter ChangePasswordEnabled, is not available in Exchange Online!
How to do this in Exchange Online? Using RBAC!
As described in one of my previous blog posts (Exchange Online (Office365) and RBAC?), you can create and assign custom roles in Exchange Online. The permission to change your password, is included in the default role assigned to any mail-enabled user in Exchange Online. It is included in the role MyBaseOptions.
First I will create a new role AllButChangePassword, and make it a copy of the existing MyBaseOptions role.
Looking at the parameters that can be set using Set-Mailbox within the role AllButChange Password, it is visible that password is included:
Time to remove it:
And then to create a new RoleAssignmentPolicy, which will include the AllButChangePassword:
Then assign the new role to my test user:
And time to test!
Logging in to OWA as test user, going back to ECP, the ability to change the password is gone!
Exchange ROCKS!
Ilse