# Password Policy

> The Domain Password Policy enforces password expiration and complexity requirements to enhance account security.

The Domain Password Policy enforces password expiration and complexity requirements to enhance account security. It defines how long passwords remain valid, when users are notified of upcoming expiration, and helps protect against unauthorized access by requiring regular password changes and strong password practices.

## Settings this baseline controls

| Setting                  | What it does                                                                                                                                                                                                                                                                          |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Expiry warning window    | Specifies the number of days before a user receives notification that their password will expire. If the property is not set, a default value of 14 days will be used. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad) |
| Password validity period | Specifies the length of time that a password is valid before it must be changed. If the property is not set, a default value of 90 days will be used. [Learn more](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad)                  |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

Add this to the tenant, or through a scheme, wherever you want cloud passwords to expire on a schedule instead of following Microsoft's default of never expiring.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Set **Password validity period** to 365 days, so users change their password once a year rather than never.
3. Set **Expiry warning window** to 14 days, so users are warned in good time before their password stops working rather than being surprised at sign-in.
4. Save. **Auto-remediation** is safe here: it only reapplies the same two values if someone changes them in Microsoft 365.

> **Note:** This applies only to cloud-only accounts. Users whose passwords sync from an on-premises Active Directory keep following your on-premises expiry policy.

## Check it worked

Passing means **Microsoft 365 admin centre → Settings → Org settings → Security & privacy → Password expiration policy** shows expiry set to 365 days with a 14-day warning, for every domain in the tenant. Cloud-only users start seeing a password-expiry warning about two weeks before they have to change it.

## Standards this addresses

### CIS

- **M365 1.3.1** — CIS M365 Foundations Benchmark 1.3.1
- **v8 5.2** — CIS Controls v8 Safeguard 5.2

### NIST

- **PR.AC-4** — NIST CSF 2.0 PR.AC-4
- **IA-5** — NIST SP 800-53 IA-5
- **AC-2** — NIST SP 800-53 AC-2

### ISO 27001

- **A.5.17** — ISO/IEC 27001:2022 Annex A.5.17
- **A.8.6** — ISO/IEC 27001:2022 Annex A.8.6

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)