Check ID:
Provider: Microsoft 365
Service:
Severity: MEDIUM
Categories:
Resource type:
admincenter_settings_password_never_expireProvider: Microsoft 365
Service:
admincenterSeverity: MEDIUM
Categories:
identity-access, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 tenant password policy is configured so user passwords do not expire (never expire), meaning no time-based rotation is enforced across accounts.
Risk
Forced password expiration degrades security: users adopt predictable patterns and reuse credentials, reducing confidentiality and integrity. It boosts success of password spraying and credential stuffing, encourages insecure storage and helpdesk resets, and can disrupt service accounts, impacting availability.Recommendation
Set passwords tonever expire and enforce layered controls: MFA with risk-based challenges, banned-password checks, and strong length. Apply least privilege and monitor sign-ins. Rotate credentials only after compromise or risk, and favor managed non-human identities for automation instead of time-based password cycling.
Remediation
- CLI
- Dashboard steps
Set-MsolPasswordPolicy -DomainName <DOMAIN_NAME> -ValidityPeriod 2147483647
References
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = admincenter_settings_password_never_expire. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks