Password Policy
The Domain Password Policy enforces password expiration and complexity requirements to enhance account security. It defines how long passwords remain valid, when users are notified of upcoming expiration, and helps protect against unauthorized access by requiring regular password changes and strong password practices.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Expiry warning window | Specifies the number of days before a user receives notification that their password will expire. If the property is not set, a default value of 14 days will be used. Learn more |
| Password validity period | Specifies the length of time that a password is valid before it must be changed. If the property is not set, a default value of 90 days will be used. Learn more |
Configure it
Add this to the tenant, or through a scheme, wherever you want cloud passwords to expire on a schedule instead of following Microsoft’s default of never expiring.
-
Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).
-
Set Password validity period to 365 days, so users change their password once a year rather than never.
-
Set Expiry warning window to 14 days, so users are warned in good time before their password stops working rather than being surprised at sign-in.
-
Save. Auto-remediation is safe here: it only reapplies the same two values if someone changes them in Microsoft 365.
Check it worked
Passing means Microsoft 365 admin centre → Settings → Org settings → Security & privacy → Password expiration policy shows expiry set to 365 days with a 14-day warning, for every domain in the tenant. Cloud-only users start seeing a password-expiry warning about two weeks before they have to change it.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.