Microsoft Entra ID

Customer intent: As a Microsoft Entra Administrator, I want to learn how to enable and use password writeback so that when end-users reset their pass…

5 November 2026Doc update+9 / −8 lines

In brief

The guide now warns that first-time password writeback enablement may generate password change events 656 and 657 during password hash resynchronization. It also clarifies steps for stopping cloud sync writeback or all password writeback.

What Entra admins need to know

Administrators should expect these events during initial enablement and can use the clarified cleanup guidance when changing writeback configurations.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Tutorial: Enable Microsoft Entra self-service password reset writeback to an on-premises environment

Under Permissions, select the box for Reset password.
Under Properties, select the boxes for the following options. Scroll through the list to find these options, which might already be set by default:

Write lockoutTime
Write pwdLastSet

:::image type="content" source="media/tutorial-enable-sspr-writeback/set-ad-ds-permissions-cropped.png" alt-text="Set the appropriate permissions in Active Users and Computers for the account that Microsoft Entra Connect uses." lightbox="media/tutorial-enable-sspr-writeback/set-ad-ds-permissions.png":::

For Principal, select the account that permissions should be applied to (the account Microsoft Entra Connect uses).
In the Applies to drop-down list, select This object and all descendant objects
Under Permissions, select the box for the following option:
- Unexpire Password
When ready, select Apply / OK to apply the changes and exit any open dialog boxes.

When you update permissions, it might take up to an hour or more for these permissions to replicate to all the objects in your directory.

One of the configuration options in Microsoft Entra Connect is for password writeback. When this option is enabled, password change events cause Microsoft Entra Connect to synchronize the updated credentials back to the on-premises AD DS environment.

~~To enable SSPR writeback, first enable the writeback option in Microsoft Entra Connect. From your Microsoft Entra Connect server, complete the following steps:~~

~~Sign in to your Microsoft Entra Connect server and start the~~ ~~Microsoft Entra Connect~~ ~~configuration wizard.~~
~~Uncheck the option for~~ ~~Allow users to unlock accounts without resetting their password~~.
~~When ready, select~~ ~~Save~~.

If you no longer want to use the Microsoft Entra Connect cloud sync for SSPR writeback functionality but want to continue using Microsoft Entra Connect Sync agent for writebacks complete the following steps:

~~Sign in to the Microsoft Entra admin center~~
Important
Enabling password writeback for the first time might trigger password change events 656 and 657, even if a password change hasn't occurred. This is because all password hashes are resynchronized after a password hash synchronization cycle runs.

To enable SSPR writeback, first enable the writeback option in Microsoft Entra Connect. From your Microsoft Entra Connect server, complete the following steps:
1. Sign in to your Microsoft Entra Connect server and start the Microsoft Entra Connect configuration wizard.
2. Uncheck the option for Allow users to unlock accounts without resetting their password.
3. When ready, select Save.
To stop using Microsoft Entra Connect cloud sync for SSPR writeback while continuing to use the Microsoft Entra Connect Sync agent, complete the following steps:
1. Sign in to the Microsoft Entra admin center as at least a Hybrid Identity Administrator.
2. Browse to Entra ID > Password reset, then choose On-premises integration.
3. Uncheck the option for Write back passwords with Microsoft Entra Connect cloud sync.
4. When ready, select Save.
If you no longer want to use ~~any~~ password ~~functionality,~~writeback in Microsoft Entra Connect, complete the following steps from your Microsoft Entra Connect server:
1. Sign in to your Microsoft Entra Connect server and start the Microsoft Entra Connect configuration wizard.
2. On the Welcome page, select Configure.
3. On the Ready to configure page, select Configure and wait for the process to finish.
4. When you see the configuration finish, select Exit.
Important
Enabling password writeback for the first time might trigger password change events 656 and 657, even if a password change hasn't occurred. This is because all password hashes are resynchronized after a password hash synchronization cycle runs.

Next steps

In this tutorial, you enabled Microsoft Entra SSPR writeback to an on-premises AD DS environment. You learned how to:

Next steps
In this tutorial, you enabled Microsoft Entra SSPR writeback to an on-premises AD DS environment. You learned how to:

@@ -6,6 +6,7 @@ ms.date: 05/27/2026 ms.reviewer: tilarso ms.custom: msecd-doc-authoring-106 adobe-target: true+ai-usage: ai-assisted # Customer intent: As a Microsoft Entra Administrator, I want to learn how to enable and use password writeback so that when end-users reset their password through a web browser their updated password is synchronized back to my on-premises AD environment. --- # Tutorial: Enable Microsoft Entra self-service password reset writeback to an on-premises environment@@ -71,8 +72,8 @@ To set up the appropriate permissions for password writeback to occur, complete 1. Under **Permissions**, select the box for **Reset password**. 1. Under **Properties**, select the boxes for the following options. Scroll through the list to find these options, which might already be set by default: -* **Write lockoutTime**-* **Write pwdLastSet**+    * **Write lockoutTime**+    * **Write pwdLastSet**      :::image type="content" source="media/tutorial-enable-sspr-writeback/set-ad-ds-permissions-cropped.png" alt-text="Set the appropriate permissions in Active Users and Computers for the account that Microsoft Entra Connect uses." lightbox="media/tutorial-enable-sspr-writeback/set-ad-ds-permissions.png"::: @@ -81,7 +82,7 @@ To set up the appropriate permissions for password writeback to occur, complete 1. For **Principal**, select the account that permissions should be applied to (the account Microsoft Entra Connect uses). 1. In the **Applies to** drop-down list, select **This object and all descendant objects** 1. Under **Permissions**, select the box for the following option:-   * **Unexpire Password**+    * **Unexpire Password** 1. When ready, select **Apply / OK** to apply the changes and exit any open dialog boxes.  When you update permissions, it might take up to an hour or more for these permissions to replicate to all the objects in your directory.@@ -99,6 +100,9 @@ If you update the group policy, wait for the updated policy to replicate or use  One of the configuration options in Microsoft Entra Connect is for password writeback. When this option is enabled, password change events cause Microsoft Entra Connect to synchronize the updated credentials back to the on-premises AD DS environment. +> [!IMPORTANT]+> Enabling password writeback for the first time might trigger password change events 656 and 657, even if a password change hasn't occurred. This is because all password hashes are resynchronized after a password hash synchronization cycle runs.+ To enable SSPR writeback, first enable the writeback option in Microsoft Entra Connect. From your Microsoft Entra Connect server, complete the following steps:  1. Sign in to your Microsoft Entra Connect server and start the **Microsoft Entra Connect** configuration wizard.@@ -138,14 +142,14 @@ If you no longer want to use the SSPR writeback functionality you have configure 1. Uncheck the option for **Allow users to unlock accounts without resetting their password**. 1. When ready, select **Save**. -If you no longer want to use the Microsoft Entra Connect cloud sync for SSPR writeback functionality but want to continue using Microsoft Entra Connect Sync agent for writebacks complete the following steps:+To stop using Microsoft Entra Connect cloud sync for SSPR writeback while continuing to use the Microsoft Entra Connect Sync agent, complete the following steps:  1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as at least a [Hybrid Identity Administrator](~/identity/role-based-access-control/permissions-reference.md#hybrid-identity-administrator). 1. Browse to **Entra ID** > **Password reset**, then choose **On-premises integration**. 1. Uncheck the option for **Write back passwords with Microsoft Entra Connect cloud sync**. 1. When ready, select **Save**. -If you no longer want to use any password functionality, complete the following steps from your Microsoft Entra Connect server:+If you no longer want to use password writeback in Microsoft Entra Connect, complete the following steps from your Microsoft Entra Connect server:  1. Sign in to your Microsoft Entra Connect server and start the **Microsoft Entra Connect** configuration wizard. 1. On the **Welcome** page, select **Configure**.@@ -156,9 +160,6 @@ If you no longer want to use any password functionality, complete the following 1. On the **Ready to configure** page, select **Configure** and wait for the process to finish. 1. When you see the configuration finish, select **Exit**. -> [!IMPORTANT]-> Enabling password writeback for the first time might trigger password change events 656 and 657, even if a password change hasn't occurred. This is because all password hashes are resynchronized after a password hash synchronization cycle runs.- ## Next steps  In this tutorial, you enabled Microsoft Entra SSPR writeback to an on-premises AD DS environment. You learned how to: