Detections
Analytics

1.3.1 Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'

Information

Microsoft cloud-only accounts have a pre-defined password policy that cannot be changed. The only items that can change are the number of days until a password expires and whether or not passwords expire at all.

Organizations such as NIST and Microsoft recommend against arbitrarily requiring users to change their passwords after a set period, unless there is evidence of compromise or the user has forgotten the password. This guidance applies even to single-factor (password-only) scenarios, as forced, periodic changes often lead to weaker passwords and reduced security. Additionally, this Benchmark advises implementing multi-factor authentication (MFA) for all accounts, which further diminishes the value of password expiration policies. Long-lived passwords can be further strengthened by enabling additional password protection features in Entra ID.

Solution

To remediate using the UI:

 - Navigate to Microsoft 365 admin center https://admin.microsoft.com.
 - Expand Settings > Org Settings.
 - Click on Security & privacy.
 - Check the Set passwords to never expire (recommended) box.
 - Click Save.

To remediate using PowerShell:

 - Connect to the Microsoft Graph service using Connect-MgGraph -Scopes "Domain.ReadWrite.All".
 - Run the following Microsoft Graph PowerShell command:

Update-MgDomain -DomainId <Domain> -PasswordValidityPeriodInDays 2147483647

Impact:

When setting passwords not to expire it is important to have other controls in place to supplement this setting. See below for related recommendations and user guidance.

 - Ban common passwords.
 - Educate users to not reuse organization passwords anywhere else.
 - Enforce Multi-Factor Authentication registration for all users.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1)(d)

Plugin: microsoft_azure

Control ID: 375d7df4c20823f1f4fa4a1dcfcbd0fcd046e81c9021d6023a32eea8c01f8b61