Microsoft 365: Password Expiration Notification Email

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.Read.All", "Mail.Send"

# Set the notification threshold - days before password expires
$NotificationThreshold = 7
$PasswordExpiryThreshold = 90 #By default 90 days Password expiry

# Get all users
$AllUsers = Get-MgUser -All -Property Id, DisplayName, UserPrincipalName,Mail,UserType, AccountEnabled,PasswordPolicies,lastPasswordChangeDateTime

# Iterate through each user
ForEach ($User in $AllUsers) 
{
    # Skip disabled accounts and users with Password never Expire flag
    If (!$User.AccountEnabled -or $User.PasswordPolicies -contains "xDisablePasswordExpiration" -or $User.userType -eq "Guest") {
        continue
    }

    # Get user's password Expiry Date
    $PasswordExpiryDate = $User.lastPasswordChangeDateTime.AddDays($PasswordExpiryThreshold)

    # Calculate the remaining days
    $RemainingDays = ($PasswordExpiryDate - (Get-Date)).Days

    # Check if the remaining days are within the notification threshold
    If ($RemainingDays -le $NotificationThreshold) {
        # Send an email notification to the user
        $EmailBody = "
            Hello $($User.DisplayName),
            <br/><br/>
            Your Office 365 password will expire in $remainingDays days. Please change your password before it expires to avoid any disruption in accessing your account.
            <br/><br/>
            To change your password, follow these steps:<br/>
            <ol>
            <li>Sign in to Office 365 (https://www.office.com)</li>
            <li>Click on your profile picture in the top right corner.</li>
            <li>Select 'View account'.</li>
            <li> Click 'Password'.</li>
            <li> Follow the instructions to change your password.</li>
            </ol>
            <br/>
            Thank you,<br/>
            IT Support Team
        "

    $MailParams = @{
	    Message = @{
		    Subject = "Your Office 365 password will expire soon"
            Importance = "High"
		    Body = @{
			    ContentType = "html"
			    Content = $EmailBody
		    }
		    ToRecipients = @(
			    @{
				    EmailAddress = @{
					    Address = $User.Mail
				    }
                }
		    )
	    }
    }
    # Send the email using Microsoft Graph
    Send-MgUserMail -UserId $User.Mail -BodyParameter $MailParams
    }
}

#Parameters
$TenantID = "c1c2b123-4240-4775-a19a-6351b30cx2f6"
$ClientID = "3c1541f7-9565-4abe-b398-f47ac91c2c06" #App ID
$CertThumbPrint = "63FDDD207DE01C0EB34C35647D086D3C1520FA7"
#Path for Log File
$LogFilePath = "C:\Scripts\PasswordExpiry.Log"
$SenderID = "Helpdesk@Crescent.com"
#Notification threshold - days before password expires
$NotificationThreshold = 15
$PasswordExpiryThreshold = 90 #By default 90 days Password expiry

#Function to Add Content to a Log File
Function Write-Log {
 
  [CmdletBinding()]
   
  Param ([Parameter(Mandatory=$true)][string]$Message)  

  Process{
        #Add Message to Log File with timestamp
        "$([datetime]::Now) : $Message" | Out-File -FilePath $LogFilePath -append;
   
        #Write the log message to the screen
        Write-host $([datetime]::Now) $Message
    }
}

#Connect to Microsoft Graph using App
Connect-MgGraph -ClientID $ClientID -TenantId $TenantID -CertificateThumbprint $CertThumbPrint

#Ensure the Parent Folder for Log File
$FolderPath= Split-Path $LogFilePath
If(!(Test-Path -path $FolderPath)) {  
    New-Item -ItemType directory -Path $FolderPath | Out-Null
}

# Get all users
$AllUsers = Get-MgUser -All -Property Id, DisplayName, UserPrincipalName,Mail,UserType, AccountEnabled,PasswordPolicies,lastPasswordChangeDateTime

# Iterate through each user
ForEach ($User in $AllUsers) 
{
    # Skip disabled accounts and users with Password never Expire flag
    If (!$User.AccountEnabled -or $User.PasswordPolicies -contains "DisablePasswordExpiration" -or $User.userType -eq "Guest") {
        continue
    }

    # Get user's password Expiry Date
    $PasswordExpiryDate = $User.lastPasswordChangeDateTime.AddDays($PasswordExpiryThreshold)

    # Calculate the remaining days
    $RemainingDays = ($PasswordExpiryDate - (Get-Date)).Days

    # Check if the remaining days are within the notification threshold
    If ($RemainingDays -le $NotificationThreshold -and $RemainingDays -ge 0) {
        # Send an email notification to the user
        $EmailBody = "
            Hello $($User.DisplayName),
            <br/><br/>
            Your Office 365 password will expire in $remainingDays days. Please change your password before it expires to avoid any disruption in accessing your account.
            <br/><br/>
            To change your password, follow these steps:<br/>
            <ol>
            <li>Sign in to Office 365 (https://www.office.com)</li>
            <li>Click on your profile picture in the top right corner.</li>
            <li>Select 'View account'.</li>
            <li> Click 'Password'.</li>
            <li> Follow the instructions to change your password.</li>
            </ol>
            <br/>
            Thank you,<br/>
            IT Support Team
        "

    $MailParams = @{
	    Message = @{
		    Subject = "Your Office 365 password will expire soon"
            Importance = "High"
		    Body = @{
			    ContentType = "html"
			    Content = $EmailBody
		    }
		    ToRecipients = @(
			    @{
				    EmailAddress = @{
					    Address = $User.Mail
				    }
                }
		    )
	    }
    }
    # Send the email using Microsoft Graph
    Send-MgUserMail -UserId $SenderID -BodyParameter $MailParams
    
    #Write to Log File
    Write-Log "Password Expiration Notification sent to user $($User.Mail) - Password Expires on $PasswordExpiryDate"
    }
}