Configuring Organization’s Password Policy in Microsoft 365

6.2K

When you sign up for a new Microsoft 365 tenant, a default password policy is already in place that Microsoft considers optimal. It helps secure your users’ accounts by forcing a set of rules for creating or updating their passwords.

But can you configure these password policies? Yes, but not all. There’s a small subset of customizable password policy settings, but the majority are not.

The Default Password Policy in Microsoft 365

The following are the default password policy settings for users created and managed directly in the cloud.

Non-Customizable Password Policy Settings

Below are the non-configurable Microsoft 365 password policy settings.

• Allowed characters:
  • A – Z
  • a – z
  • 0 – 9
  • @ # $ % ^ & * – _ ! + = [ ] { } |  : ’ , . ? / ` ~ ” ( ) ; < >
  • Blank space
• Disallowed characters:
  • Unicode characters (e.g., ℗, β)
• Complexity:
  • The password length is between 8 and 256 characters.
  • The password must contain three out of the four character types: lowercase, uppercase, numbers, and symbols.
    

    Note. Microsoft Entra ID automatically checks new and changed passwords against a list of known weak passwords and their common variations (for example, “P@ssw0rd” or “Spring2024!”). This protection is enabled by default and cannot be disabled.

• Password reuse:
  • The last password cannot be reused when the user changes or resets a password.

Note. Even if you have a Microsoft Entra ID P1 or P2 license, the minimum password length of 8 characters is fixed for cloud-only users and cannot be increased. Organizations that require longer passwords can enforce them through on-premises AD password policies (GPO/Fine-Grained Password Policies) in a hybrid environment. In this case, password length and complexity requirements are enforced when users change their passwords in on-premises AD before the password hash is synced to Microsoft Entra ID.

Keep in mind that these on-premises password requirements apply only to synced users whose passwords are managed in AD. Note that cloud-only accounts continue to use the built-in Microsoft Entra ID password requirements.

Customizable Password Policy Settings

Below are the Microsoft 365 password policy settings you can configure and customize.

• Password expiration policy (maximum password age):
  • For tenants created after 2021, there is no default maximum password age. Meaning that passwords do not expire by default.
  • Otherwise, the default maximum password age was 90 days.
• Custom smart account lockout:
  • The user account is locked out after ten unsuccessful login attempts.
  • The initial user account lockout duration is 60 seconds, increasing if the account gets locked out repeatedly.
• Custom banned passwords list:
  • Microsoft automatically applies a global banned password list to all users in all tenants. The list is maintained by Microsoft based on real-world attack data and you can’t disable it.
  • Admins also have an option to configure a custom banned password list with organization-specific terms (e.g., company name, product names). By default, this feature is disabled and requires you to enable Entra ID Password Protection.

Note. By default, the Smart lockout is enabled for all tenants. However, in case you want to customize the lockout threshold/lockout duration, you will need a Microsoft Entra ID P1 or P2 license. If you don’t have a license, the default values (10 attempts, 60 seconds) are applied and you can’t change them.

Enabling the Microsoft 365 Password Policy for On-Premises AD Users

By default, password expiration settings for synced users are inherited from the on-premises AD environment. The CloudPasswordPolicyForPasswordSyncedUsersEnabled syncing feature allows Microsoft Entra ID cloud password expiration policies to be applied to password-synced users. This feature controls this behavior.

To apply the Microsoft 365 password policy to synchronized on-premises AD accounts, enable the CloudPasswordPolicyForPasswordSyncedUsersEnabled feature by running this command in PowerShell:

Connect-MgGraph -Scopes "OnPremDirectorySynchronization.ReadWrite.All"

$Sync = Get-MgDirectoryOnPremiseSynchronization

$Sync.Features.CloudPasswordPolicyForPasswordSyncedUsersEnabled = $true

Update-MgDirectoryOnPremiseSynchronization `
    -OnPremisesDirectorySynchronizationId $Sync.Id `
    -Features $Sync.Features

You can check if the feature has been successfully enabled by running the following command:

(Get-MgDirectoryOnPremiseSynchronization).Features |
Select-Object CloudPasswordPolicyForPasswordSyncedUsersEnabled

Keep in mind that enabling this feature affects password expiration behavior for synced users. Password complexity requirements, minimum password length, and password history settings continue to be enforced by the on-premises AD password policy.

Note. This command requires the Microsoft Graph PowerShell SDK. Install it via:

Install-Module Microsoft.Graph -Scope CurrentUser

Configuring Domain Password Expiration Settings

The global password expiration policy configuration has two states: Passwords never expire, and password expires in days. You can configure these settings in the GUI or PowerShell.

Keep in mind that Microsoft currently recommends disabling routine password expiration for most organizations unless specific regulatory/compliance requirements require it.

Also Microsoft no longer recommends periodic password expiration because users often choose weaker and more predictable passwords when forced to change them regularly. Instead, you should use smart lockout, MFA, password protection, and passwordless authentication.

Using the Microsoft 365 Admin Center

Configuring the password expiration policy using the admin center will enforce it to all domains in your Microsoft 365 tenant. Meaning that if you have multiple verified domains, the same password expiration policy will be assigned to those domains.

1. Log in to the Microsoft 365 admin center.
2. Navigate to Setting → Org settings → Security & privacy and click the Password expiration policy link.
   

   

3. On the flyout page that appears, select whether never to expire passwords or manually set the days when the passwords expire. In this example, I’m choosing to expire individual user passwords every 120 days.
   

   

4. You’ll see the confirmation message once you save the password expiration policy, as shown below. You can now close the Password expiration policy flyout page.
   

   

Using the Microsoft Graph PowerShell

You can customize the password expiration policy for each domain in your organization using the Microsoft Graph PowerShell. This method requires the Microsoft Graph PowerShell module. If you don’t have it, refer to the Install the Microsoft Graph PowerShell SDK.

1. Open PowerShell and connect to Microsoft Graph API with the Domain.ReadWrite.All permission scope:
   

   Connect-MgGraph -Scopes Domain.ReadWrite.All

   
2. Next, by running this command, let’s find out the password expiration policy for each domain.
   

   Get-MgDomain | Format-Table Id,IsDefault,PasswordValidityPeriodInDays

   
   As you can see in this example, all domains’ PasswordValidityPeriodInDays value is 120, meaning the passwords for the users under these domains are valid for 120 days.
3. Suppose I want to set the password expiration policy never to expire; the command to run is this:
   

   Update-MgDomain -DomainId lazyexchangeadmin.cyou -PasswordValidityPeriodInDays 2147483647

   

   The value of 2147483647 for the PasswordValidityPeriodInDays means never to expire the password.

Configuring the Microsoft Entra Password Protection Policy

The Microsoft Entra password protection policy is a directory setting rule with three categories: Custom smart lockout, Custom banned passwords, and Password protection for Windows Server Active Directory.

Microsoft Entra Password Protection is part of the broader Authentication Methods policy framework in Microsoft Entra ID. The Authentication Methods config area is used to manage password-related protections, MFA methods, passkeys (FIDO2), Windows Hello for Business, Temporary Access Pass, Microsoft Authenticator, and other authentication options. Password Protection is one of the security controls available within this framework.

Follow these steps to configure these settings.

1. Log in to Microsoft Entra admin center.
2. Navigate to Identity → Protection → Authentication methods → Password protection in the Microsoft Entra admin center.
   

   

3. Here you need to go to Password protection. On this page, you’ll find the following configuration items:

Type	Setting	Description
Custom smart lockout	Lockout threshold	Determines how many failed logins are allowed before the user account is locked out.
	Lockout duration in seconds	The initial lockout duration. This value increases if the lockout happens consecutively.
Custom banned passwords	Enforce custom list	Microsoft Entra will check for bad passwords in the Custom banned password list if enabled.
	Custom banned password list	The list of words to check for bad passwords.
Password protection for Windows Server Active Directory	Enable password protection on Windows Server Active Directory	If enabled, the password protection policy is turned on for On-Premises AD user accounts.This setting requires that the Microsoft Entra Password Protection Proxy be installed on the on-premises domain controller for it to work.
	Mode	If set to Enforced, synced users will be prevented from using banned passwords.If set to Audit, synced users can use the banned passwords, and the attempt will be logged

Wrapping up

The Microsoft 365 password policy settings are essential security mechanisms to protect users’ passwords from possible compromise. Such settings include password expiration, smart account lockout, and a custom banned passwords list.

Keep in mind that password policies alone are no longer considered sufficient protection against modern identity-based attacks. We recommend using Conditional Access policies (require Microsoft Entra ID P1 or P2 licensing) to control how and when users can access organizational resources. For example, Conditional Access can require multi-factor authentication (MFA), block sign-ins from risky locations, restrict access from unmanaged devices, or enforce additional security requirements based on user risk and sign-in risk.

Microsoft is actively moving to passwordless authentication. Nowadays, Entra ID supports passkeys, Windows Hello for Business, and the Authenticator app as alternatives to passwords.

In case your organization is planning a long-term identity security strategy, you should consider gradually adopting passwordless authentication methods such as passkeys, Windows Hello for Business, and Temporary Access Pass. Using these technologies you can reduce the risks associated with traditional passwords while improving the user sign-in experience.