Password Reset Failure for Duo SSO Logins using Active Directory

Summary 

On May 19, 2025, around 19:00 ET, Duo received reports of users who were unable to reset their Active Directory (AD) passwords through Duo SSO. This impacted all users who were attempting to reset an expired AD password. Functionality was restored to all deployments at 20:46 ET.  

Timeline of Events 

12:53 ET: A planned update to SSO services is rolled out. 

19:05 ET: Duo engineering is alerted of multiple customers who are unable to reset expired passwords for AD 

19:26 ET: Duo begins deploying a fix for the expired password reset issue 

19:57 ET: Duo receives confirmation that some customers are seeing restored service, fix continues to be rolled out for additional deployments 

20:46 ET: Fix is rolled out to all deployments and service is restored 

Details 

An update was released that introduced a code change to our logic for determining whether or not to direct users to reset their expired AD password. This code change contained a bug which resulted in authentications being mistaken as invalid instead of requiring a password change. 

During the duration of this issue, 526 customers were identified as having one or more users who were blocked from resetting their password. 

In addition to fixing the bug that caused this issue: 

• Engineering is planning to increase our observability on this specific type of issue to improve our response time in the future. 

• Engineering is planning to improve our automated testing for this password reset flow.