Retrieve Password Expiry in Entra ID

Password expiry in Microsoft Entra ID is not stored as a single “expiry date” property. Instead, Entra tracks:

• Last password change timestamp
• Password policies (max age, notification window, etc.)
• Whether the account has password expiration disabled

You get the actual expiry date by calculating:

passwordLastSet + passwordAgePolicy

Below are the best methods to retrieve this.

Install the module

Install-Module Microsoft.Graph -Scope AllUsers
Show more lines

Connect

Connect-MgGraph -Scopes "User.Read.All"

Retrieve password info for one user

Get-MgUser -UserId "user@domain.com" -Property passwordPolicies,passwordLastSet
Show more lines

Retrieve expiry date for all users

$users = Get-MgUser -All -Property DisplayName,UserPrincipalName,passwordPolicies,passwordLastSet

$maxAgeDays = 90   # Or whatever your tenant uses

$users | Select-Object `

    DisplayName,

    UserPrincipalName,

    passwordLastSet,

    @{n="PasswordExpiryDate";e={($_.passwordLastSet).AddDays($maxAgeDays)}}

If the user has:

• passwordPolicies containing DisablePasswordExpiration
  → Password never expires