No Ticket Needed

Appearance

11 min read Recently reviewedBeginner

By , IT support technician

Understanding Password Resets — Active Directory vs. Microsoft 365 ​

Applies to: Windows 11, Windows 10 (domain-joined and Entra-joined); Microsoft 365 (Outlook, Teams, SharePoint, OneDrive)
Article Type: Informational
Last Updated: 2026-07-29

Summary ​

Your work account usually lives in two places at once: an on-premises directory your Windows laptop signs into, and a cloud directory behind Microsoft 365. This article explains how those two relate, why a password change sometimes lands in one and not the other, and where a reset actually has to happen so every app agrees.

Prerequisites ​

  • A work or school account issued by your employer.
  • Your current password, or a working self-service reset method if you have already lost it.

Instructions ​

1. The Two Directories Behind Your Work Account ​

There are two separate systems that can hold your work password. Most office workers never see either one, which is exactly why a password change can feel unpredictable.

  • On-premises Active Directory — A server (a domain controller) sitting in your company's own server room or data centre. This is what your Windows laptop authenticates against when you press Ctrl + Alt + Delete and sign in. It also usually backs file shares, network printers, VPN, and older line-of-business applications. Its username format is DOMAIN\yourname, for example CONTOSO\jsmith.
  • Microsoft Entra ID — Microsoft's cloud directory, renamed from Azure Active Directory and still labelled Azure AD in plenty of screens and documentation. This is what Microsoft 365 authenticates against: Outlook, Teams, SharePoint, OneDrive, the Microsoft 365 web apps, and anything your company signs into with your work email address. Its username format is your email address, for example [email protected].

Two directories, two password stores. Everything confusing about work passwords comes from that one fact.

2. Why the Two Usually Feel Like One Password ​

Companies do not want staff memorising two passwords, so they link the directories with a tool called Microsoft Entra Connect (previously Azure AD Connect), running on a server on the company network. There are three ways it can be set up, and which one you have determines where a reset works.

ModelWhat it doesWhere the password really lives
Password hash syncCopies a scrambled, one-way version of your Active Directory password up to the cloud roughly every 2 minutesOn-premises, with a synced copy in the cloud
Pass-through authenticationNothing is copied. Every cloud sign-in is passed back to a domain controller on the company network for checkingOn-premises only
Federation (AD FS)Microsoft 365 hands you off to a company sign-in page, which checks with Active Directory and issues a tokenOn-premises only
Cloud-only accountNo on-premises directory involved at allIn Microsoft Entra ID only

In the first three models you type the same password everywhere, so it behaves like one password. It is not one password — it is one password value being checked in two places, and the two can drift apart for a few minutes at a time.

Note: Password hash sync copies a mathematical fingerprint of your password, not the password itself. Nobody at Microsoft or in your IT department can read it back out.

3. How to Tell Which Model You Are In ​

You do not need admin rights to work this out. Two checks cover almost every setup.

  1. Press Ctrl + Alt + Delete on your work laptop and select Change a password. If the screen shows a domain name above or beside the username box — something like CONTOSO\jsmith rather than an email address — the laptop signs into on-premises Active Directory.
  2. Open Settings (press Windows key + I), go to Accounts > Access work or school, and click the entry listed there. If the details read Connected to Contoso's Azure AD with no domain name, the device is joined to the cloud directory only.
What you seeWhat it meansPractical consequence
DOMAIN\username at the Windows sign-in screenDomain-joined, on-premises Active DirectoryYour Windows password is the master copy. Change it on the machine, on the network or VPN.
Your email address at the Windows sign-in screen, no domain listedEntra-joined, cloud-onlyOne password, changed in the cloud. Nothing to sync.
An unfamiliar company-branded sign-in page when you open Outlook on the webFederation (AD FS)The cloud never holds your password. Reset happens on-premises.

4. Where a Reset Actually Has to Happen ​

This is the part that generates tickets. The right place to change your password depends entirely on the model above.

  • Cloud-only account — Go to myaccount.microsoft.com, sign in, select Password in the left sidebar, and enter the old and new values. Step-by-step detail is in How to Change Your Microsoft 365 Password.
  • Domain-joined, with password writeback enabled — Either place works. A change made in the cloud is written back down to Active Directory, and a change made on the laptop syncs up. Most mid-size companies run this configuration.
  • Domain-joined, without password writeback — The cloud portal rejects the change with a message along the lines of You can't change your password here or hands you back to a company page. The change has to be made against Active Directory, using Ctrl + Alt + Delete > Change a password while on the corporate network or connected to VPN. See How to Change Your Windows Password on a Domain-Joined Computer.
  • Federated (AD FS) — The Microsoft 365 password page is not available to you at all. Use the company sign-in page or the laptop itself.

Tip: If your company has enabled self-service password reset, you can recover a forgotten password yourself instead of waiting on a ticket. Register your phone and alternate email in advance — see How to Set Up Self-Service Password Reset (SSPR).

5. The Lag — Why the Old Password Still Works for a While ​

A password change is not instant everywhere. Four separate delays stack up, and together they explain almost every "it half worked" report.

DelayTypical durationWhat you observe
Directory sync intervalAbout 2 minutes, up to 30 in some setupsWindows accepts the new password, Microsoft 365 still expects the old one
Existing access tokensUp to 1 hour, sometimes longer on desktop appsOutlook and Teams stay signed in on the old password and only fail at renewal
Cached Windows credentialsUntil the laptop next reaches a domain controllerThe lock screen still accepts the old password on a machine off the network
Saved credentials in appsUntil you update themRepeated prompts from Outlook, VPN, mapped drives, and mobile mail

During that window both passwords work, in different places. That is expected behaviour, not a fault — and it closes on its own once the laptop reaches the network and the apps renew their tokens.

6. The Symptoms of a Half-Completed Change ​

Match what you are seeing against this list to work out which half completed.

Windows accepts the new password, but Outlook keeps prompting The change landed in Active Directory and has not reached the cloud yet, or Outlook is holding a stale saved credential. Wait a few minutes, then sign out of Outlook and back in. If prompts continue, clear the old entry: open Credential Manager from the Start menu, select Windows Credentials, find the entries beginning MicrosoftOffice or your email address, and click Remove. Full walkthrough in How to Fix Outlook Keeps Asking for Password — Sign-In Loop and Credential Prompts.

Microsoft 365 on the web accepts the new password, but the laptop lock screen rejects it Your laptop has not spoken to a domain controller since the change. Sign in with the old password, connect to VPN, then press Ctrl + Alt + Delete, choose Lock, and unlock with the new one.

Teams and Outlook work, but mapped drives and network printers ask for credentials Those connections authenticate against Active Directory separately. Reconnect them and tick Remember my credentials when prompted.

Your account locks itself out a few minutes after every change A device is still retrying the old password in the background — most often a phone's mail app, a saved VPN profile, or a signed-in tablet. Update the password on every device, then unlock the account using How to Unlock Your Account After Too Many Failed Sign-In Attempts.

Windows Hello or your PIN stops working after a password change The PIN is tied to the device and is normally unaffected, but a policy change or a TPM issue can invalidate it. How to Fix Windows Sign-In Errors — PIN, Password, and Windows Hello Issues covers recovery.

7. The Rule of Thumb — What to Change, Where, and in What Order ​

Follow this sequence and the two directories stay in step.

  1. Connect to the corporate network or VPN first. Do this before you touch anything. It is the single largest cause of a change landing in one directory only.
  2. Change it on the laptop if you have a domain, in the browser if you do not. With a DOMAIN\username sign-in screen, use Ctrl + Alt + Delete > Change a password. With an email-address sign-in screen, use myaccount.microsoft.com.
  3. Wait 5 minutes before judging the result. Sync and token renewal need that time. Prompts inside the first few minutes are expected.
  4. Update every device you own before you walk away. Phone mail, tablet, home laptop, saved VPN profile, and any app with a remembered password. This prevents the lockout described above.
  5. Lock and unlock the laptop while still on the network. This refreshes the cached credential so the new password works offline afterwards.

When IT genuinely has to do it

Some situations cannot be self-resolved. Send a ticket with the exact wording below rather than a general description — it routes to the right team the first time. How to Submit an Effective IT Support Ticket covers what else to include.

  • Password writeback is off and the cloud portal refuses the change: "My Microsoft 365 password change is rejected in the portal. Please confirm whether password writeback is enabled for my account, or reset my Active Directory password directly."
  • You are remote with no VPN and an expired domain password: "My Active Directory password has expired and I cannot connect to VPN to change it. Please reset my domain password and provide a temporary one I can change at next sign-in."
  • Self-service reset is unavailable: "Self-service password reset is not enabled on my account. Please enable SSPR for me, or reset my password manually."
  • Repeated lockouts with no obvious source: "My account locks out repeatedly. Please check the lockout source in the security logs and tell me which device or service is retrying the old password."

Troubleshooting ​

INFO

A password change that works in one place and not the other is almost always a timing or a connectivity problem, not a broken account. Give it 5 minutes on the corporate network or VPN before assuming anything went wrong.

Symptom / ErrorPotential CauseSolution
You can't change your password herePassword writeback disabled for your accountChange it on the laptop instead using Ctrl + Alt + Delete > Change a password while on the network or VPN (Step 4).
New password works on the web, rejected at the Windows lock screenLaptop still using its cached credentialSign in with the old password, connect to VPN, then lock and unlock the machine (Step 6).
Outlook prompts for a password every few minutesStale saved credentialRemove the old entries under Windows Credentials in Credential Manager, then sign back in.
The system cannot change your password at this timeNo path to a domain controllerConnect to VPN or work from the office, then retry. The domain must be reachable at the moment of the change.
Account locks within minutes of every changeA device is retrying the old passwordUpdate the password on phone mail, VPN profiles, and tablets. If the source is unclear, ask IT to identify the lockout source in the security logs.
Company-branded sign-in page appears instead of the Microsoft oneFederated setup (AD FS)Expected. Your password is checked on-premises, so reset it there rather than in the Microsoft 365 portal.