We have several accounts for long term substitutes that are created with an expiration date on their account. We currently use Office 365 with ADConnect to sync the AD accounts.
The issue that I have found is that Office 365 ignores the accountExpires attribute and continues to allow access. The only way to stop access is to delete or disable the account. I've talked to Microsoft and they have said there are no plans to address it.
Has anyone else experienced this and found a workaround?
In addition to the link provided by @joeqwerty there are a couple methods I've used.
PowerShell script that runs and checks for expired accounts or passwords, where users are found, it will then connect to Office365 and block sign-in for these accounts. [Update] if you have SSPR enabled, instead of blocking the account, you can just reset the account password to a random complex password. This way the user then can reset it local (via standard AD sync up), or from SSPR portal.
Most recently, however, we have been using AzureAD Connect Passthrough. This moves authentication back to your domain controllers. With this in place, all your account actions are honored. It's incredibly easy to setup with synced accounts. You can pair this with AzureAD Connect Seamless Sign on which allows AzureAD to use Kerberos tickets for better user experience for your users when they are in the office or on VPN.
