Check When a Microsoft 365 User's Password Expires

Check Password Expiration via Microsoft 365 Admin Center

The admin center does not show an exact expiration date, but you can determine the last password change and the tenant policy and calculate it yourself.

Step 1: Find the user's last password change

1. Sign in to the Microsoft 365 Admin Center as a Global Admin or User Admin.
2. Navigate to Users → Active users.
3. Click the display name of the target user to open their profile pane.
4. Select the Account tab.
5. Note the value under Password last changed.

Step 2: Check the tenant password policy

1. In the admin center, go to Settings → Org settings → Security & privacy.
2. Click Password expiration policy.
3. If "Set user passwords to expire after a number of days" is unchecked, passwords never expire at the tenant level — stop here.
4. If checked, note the value in Days before passwords expire (e.g. 90).

Step 3: Calculate expiration

Expiration date = Password last changed + Days before passwords expire.

Step 4: Verify the user is not exempt

1. Back on the user's profile, check the Account tab for "Password never expires". If it appears, the user is exempt regardless of tenant policy.

Check Password Expiration via Microsoft Graph API

Combine two Graph calls: one to read the user's last password change and policy flags, and one to read the tenant-wide validity period from the initial domain.

1. Get the user's password metadata

GET https://graph.microsoft.com/v1.0/users/{userPrincipalName}?$select=id,userPrincipalName,lastPasswordChangeDateTime,passwordPolicies

Example response:

{
  "id": "a1b2c3d4-...",
  "userPrincipalName": "alice@contoso.com",
  "lastPasswordChangeDateTime": "2024-08-15T14:22:10Z",
  "passwordPolicies": "None"
}

If passwordPolicies contains DisablePasswordExpiration, the user's password never expires.

2. Get the tenant password validity period

GET https://graph.microsoft.com/v1.0/domains?$select=id,isDefault,passwordValidityPeriodInDays,passwordNotificationWindowInDays

Example response (default domain object):

{
  "id": "contoso.onmicrosoft.com",
  "isDefault": true,
  "passwordValidityPeriodInDays": 90,
  "passwordNotificationWindowInDays": 14
}

A value of 2147483647 means passwords never expire at the tenant level.

3. Calculate

expirationDateTime = lastPasswordChangeDateTime + passwordValidityPeriodInDays

Required headers

• Authorization: Bearer {access_token}
• Accept: application/json

Check Password Expiration via PowerShell

The Microsoft Graph PowerShell SDK makes this straightforward. Install it once with Install-Module Microsoft.Graph -Scope CurrentUser.

Connect

Connect-MgGraph -Scopes "User.Read.All","Domain.Read.All"

Read user properties

$user = Get-MgUser -UserId "alice@contoso.com" -Property Id,UserPrincipalName,LastPasswordChangeDateTime,PasswordPolicies
$user | Select-Object UserPrincipalName,LastPasswordChangeDateTime,PasswordPolicies

Read tenant password policy

$domain = Get-MgDomain | Where-Object IsDefault -eq $true
$validityDays = $domain.PasswordValidityPeriodInDays

Calculate expiration

if ($user.PasswordPolicies -match "DisablePasswordExpiration") {
    Write-Host "Password never expires for this user."
} elseif ($validityDays -eq 2147483647) {
    Write-Host "Tenant policy: passwords never expire."
} else {
    $expires = $user.LastPasswordChangeDateTime.AddDays($validityDays)
    $daysLeft = ($expires - (Get-Date)).Days
    Write-Host "Expires on $expires ($daysLeft days remaining)"
}

The downloadable script below wraps this logic with parameter validation, error handling, and tabular output.