Script to backup and restore Azure Active Directory password hashes

Question

I am looking for a Powershell, Azure CLI, or other type of script or program which will allow me to backup and restore all user attributes including the password hash.

This azure cli command gives me much of what I want, but doesn't include the password hashes:

az ad user list --verbose

The answer to this question from 3 years ago indicates that you can use the PowerShell get-msoluser command, but this command only seems to return UserPrincipalName, DisplayName, and isLicensed. It does not return the password hash.

This product from Quest indicates that there is some way to get these password hashes.

Does anyone know of a way to get all of the user properties, including the password hash using a script or program?

Answer 1

Azure Active Directory does not expose any APIs which expose any part of the user's password, including the password hash.

I believe the product you are referencing is simply using the "recycle bin" of Azure Active Directory to restore soft-deleted items.

There is a tutorial on how to do this through the MSOL PowerShell Module here.

At no point will you gain access to the password hash of the user through this process.