Password link: one password for a person's linked accounts
With the password link on, a password a person sets in Owlie also becomes the password of their linked accounts, such as their Active Directory or Microsoft Entra ID account. The person always chooses the password. Owlie sends it to each linked account once, keeps no copy, and never shows it to anyone, administrators included.
What reaches linked accounts
Every password a person sets reaches all their linked accounts:
- a change they make in My settings, under Security;
- a reset they start themselves with Forgot? on the sign-in page;
- an account claim or password reset you start for them;
- Use my current password in My access, which sends the password they already have to one or all of their linked accounts.
Set password in My access is different: it sets one account that allows it (People can set it themselves), and only that account.
Before a change from My settings or My access, Owlie asks the person to confirm it's them: with a second factor if they have one, or, if they have none, by signing in again when their last sign-in was more than 10 minutes ago. Nobody can set a person's password for them. To help someone who is locked out, start a password reset: they choose the new password.
Turn on the password link
You need settings.modify, and Owlie asks you to sign in again if you last signed in more than 10
minutes ago.
- Go to Admin > Tenant Settings > Authentication > Login methods.
- If Owlie credentials is on with Password type set to Secure Login (OPAQUE), set it to Standard (hashed). Until you do, the Password link switch is off and says why.
- Turn on Password link and select Save changes. If the save also changes the password type, confirm the switch.
Once it's saved, accounts Owlie created on linked resources show Needs a password in My access until each person sets a password, including accounts created before the link was on. Owlie also tells those who can sign in, at most once a day.
The password link can't be on while Owlie credentials uses Secure Login: Owlie never sees a Secure Login password, so it has nothing to pass on. For the same reason, Secure Login (OPAQUE) can't be chosen while the link is on. Switching the type to Standard and turning the link on in the same save works. With Owlie credentials off (SSO or magic link only), the link works on its own: see the table below.
Link a resource
Open the resource, select the Provisioning tab, and open the Password step. The step appears when the connector's accounts have a password field.
| Setting | What it does |
|---|---|
| Password fields | The account fields that hold its password. Each gets the same value. |
| Initial password, Length | Every new account gets a random password this long (12–128 characters, 24 by default) that nobody knows. |
| Password rules | The account's own Minimum length and Kinds of character. Every password a person sets for it must meet them, so set them to match the target system. |
| Linked to the Owlie password | The account follows the person's password while the password link is on. |
| People can set it themselves | The person can set this account's password alone from My access. Leave it off for privileged accounts. |
| Check password history | Which changes must meet the target's own history and minimum-age rules: When people change their own password (default), Always, including account claims and password resets, or Never. Only some connectors, such as Active Directory, can check it. |
| Also set when the password changes | Plain values sent with every change, such as Microsoft Entra ID's "change at next sign-in" flag set to false. |
Link only one resource for each external account. Microsoft Entra ID, Microsoft Teams and OneDrive write the same Entra user, so link only one of them. Owlie doesn't stop you linking two, but their changes aren't ordered against each other, and an older password could land last.
A custom connector takes password changes when it runs on a gateway. One that runs in Owlie's cloud gives new accounts their random initial password, but password changes don't reach it, so its resources can't be linked or let people set the password themselves.
What people see
My settings names the linked accounts a change will reach before the person types anything. After a change, each account in My access shows Updating…, then Linked to your Owlie password (or Linked to your other accounts where your organization doesn't sign in with passwords). An account that didn't take the password shows Needs a password, and Owlie tells the person by email and in Owlie, with its reason. They fix it with Use my current password, a new change, or Set password where allowed.
How each sign-in setup behaves
| Your organization signs in with | The person's own change | Forgot? reset | An account claim sets | A password reset you start sets |
|---|---|---|---|---|
| Standard passwords, with the password link | Owlie password and linked accounts | Owlie password and linked accounts | Their first Owlie password and linked accounts | Their Owlie password and linked accounts, or one account |
| Standard passwords, without the password link | Owlie password | Owlie password | Their first Owlie password | Their Owlie password, or one account |
| Secure Login passwords (the link is off) | Secure Login password | Secure Login password | Their first Secure Login password | Their Secure Login password, or one account |
| SSO or magic link only, with the password link | Linked accounts (there's no Owlie password) | Not offered: there's no Owlie password | Linked accounts | Linked accounts, or one account |
| SSO or magic link only, without it | Nothing to change | Not offered | No password: it only makes their work email their sign-in email | One account |
An account claim also makes the person's work email their sign-in email in every setup. A password reset never creates an Owlie password for someone who doesn't have one.
Switching between Standard and Secure Login
Changing the password type (to Standard to use the password link, for example, or the reverse) needs nothing from your users. Sign-in takes both types while anyone still has the old one, and a person's next sign-in switches their password to the new type: the same password, stored the new way. A person has one Owlie password at most, so the old one is gone once it switches.
Until they sign in, the person can't change a password of the old type from My settings; they sign in with it once, or use Forgot?. A Forgot? reset, or a password reset you start, sets a password of the new type. A switch to Standard doesn't send the password to linked accounts; the person's next change, reset or Use my current password does.
When a password doesn't reach an account
The account's row in My access, and the account claim or password reset's history, show Owlie's reason. The common ones:
| Reason | What to do |
|---|---|
| Doesn't meet the directory's password rules | Choose another password. If the rules Owlie listed allowed it, align the resource's Password rules with the target's. |
| This account's password is managed by another system | Link the resource that owns the password, such as Active Directory, and turn the link off on this one. |
| Owlie isn't allowed to set this account's password | Give the connection the role it needs. Microsoft Entra ID needs the User Administrator role or higher; see the integration page. |
| Couldn't confirm the change; set the password again | The target didn't answer in time and may have taken it. Owlie never resends a password: set it again. |
| Couldn't reach the directory in time | Check the connection and its gateway, then set the password again. |
| This directory doesn't support password history checks | Set Check password history to Never on that resource. |
Limits
- Owlie has 15 minutes to get a change to each account, and tries again within that time when the target asks it to wait. When a target may have taken a password without confirming it, Owlie doesn't send it again. A newer change replaces an older one that hasn't been sent yet.
- A password that reaches a linked account must be at least 8 characters, whatever the account's own rules, and at most 1,024.
- The password link and Secure Login passwords can't both be on.
- Password changes don't reach custom connectors that run in Owlie's cloud; run one on a gateway to change its passwords.