Do not force periodic password expiration

Description

The password expiration policy of every managed domain of the tenant is set to never expire. Passwords are changed when there is a reason to: suspected compromise, a leaked-credentials detection (CB-M365-AUTH-030), or the user's own choice.

Password strength is ensured by other controls: MFA for all users, the banned password lists (CB-M365-AUTH-036, CB-M365-AUTH-037) and smart lockout (CB-M365-AUTH-038).

Periodic expiration of privileged account passwords is not required either: administrators use phishing-resistant MFA (CB-M365-AUTH-004), which makes the password a minor factor. Service accounts that still use passwords should be replaced by managed identities or workload identities.

Rationale

Current guidance (NIST SP 800-63B, ANSSI, Microsoft) is against arbitrary periodic changes. Users forced to rotate choose weaker passwords built on a pattern, write them down or reuse them elsewhere, and an attacker who learns the old one guesses the new one. Expiration also does not revoke a session or token already stolen.

Impact

None known. Expiration notifications are no longer shown by Microsoft 365 anyway. Synchronized users follow the on-premises Active Directory policy unless the CloudPasswordPolicyForPasswordSyncedUsersEnabled feature is turned on.

Setting

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader.
2. Browse to Settings > Org settings > Security & privacy > Password expiration policy.
3. Check that Set passwords to never expire (recommended) is selected.
4. Alternative in PowerShell (Microsoft Graph, scope Domain.Read.All): Get-MgDomain | Where-Object { $_.AuthenticationType -eq 'Managed' } | Select-Object Id, PasswordValidityPeriodInDays Each managed domain must show 2147483647.
5. Fail if the option is cleared, or if a managed domain has a finite validity period (domains added after the policy was set keep the default until the policy is saved again).

Remediation

1. Sign in to the Microsoft 365 admin center as at least a User Administrator.
2. Browse to Settings > Org settings > Security & privacy > Password expiration policy.
3. Select Set passwords to never expire (recommended) and Save. Saving again also applies the policy to domains added since.
4. Per domain in PowerShell (Microsoft Graph, scope Domain.ReadWrite.All, Domain Name Administrator): Update-MgDomain -DomainId <domain> -PasswordValidityPeriodInDays 2147483647

Rollback

Clear the option and enter a number of days (14 to 730).

References

• Set the password expiration policy for your organization Microsoft, vendor-doc, accessed 2026-10-24
• Password policies and account restrictions in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-AUTH-036 Enforce a custom banned password list with the organization's own terms
• related CB-M365-AUTH-004 Require phishing-resistant MFA for administrative roles

People and lifecycle