This message was deleted.

The NPS Extension has several limitation. I prefer the following solution https://www.deyda.net/index.php/en/2020/04/02/saml-authentication-between-citrix-microsoft-with-azure-mfa/ The "error" with the expired password should then be solved as follows. Since the beginning of the year 2020 you can also expire passwords for Azure AD (in conjunction with PasswordHashSync). To do this, connect to your server with Azure AD Connect and run the following commands in PowerShell: Connect-MsolService Get-MsolDirSyncFeatures Here you should see that EnforceCloudPasswordPolicyForPasswordSyncedUsers is set to False. Activate this with: Set-MsolDirSyncFeature -Feature EnforceCloudPasswordPolicyForPasswordSyncedUsers -Enable $true Recheck with: Get-MsolDirSyncFeatures Now we still enable this for the users: Connect-AzureAD Get-AzureADUser | Select-Object DirSyncEnabled, PasswordPolicies, AccountEnabled Get-AzureADUser -All $true | Where-Object { $_.DirSyncEnabled -eq $true -and $_.PasswordPolicies -eq 'DisablePasswordExpiration' } | ForEach-Object {Set-AzureADUser -ObjectId $_.ObjectID -PasswordPolicies None} Get-AzureADUser | Select-Object DirSyncEnabled, PasswordPolicies, AccountEnabled Get-MsolPasswordPolicy -DomainName deyda.net The following commands above are still for checking the settings.

thanks Manuel, i already tried to set the PasswordPolicies for my testuser to none but the error is the same. i will have a lock to the SAML solution you proposed.

If you have any questions...send me a DM

The SAML approach is definitely what you want - NPS extension has too many limitations and causes a bad user experience.