Set the password expiration policy for your organization
The admin center is changing. If your experience doesn't match the details presented here, see About the new Microsoft 365 admin center.
Before you begin
This article is for people who set password expiration policy for a business, school, or nonprofit. To complete these steps, you need to sign in with your Microsoft 365 admin account. What's an admin account?.
You must be a global admin or password admin to perform these steps.
If you're a user, you don't have the permissions to set your password to never expire. Ask your work or school technical support to do the steps in this article for you.
As an admin, you can make user passwords expire after a certain number of days, or set passwords to never expire.
Set password expiration policy
By default, passwords are set to expire in 90 days. Current research strongly indicates that mandated password changes do more harm than good. They drive users to choose weaker passwords, re-use passwords, or update old passwords in ways that are easily guessed by hackers. If setting password to never expire, we recommend enabling multi-factor authentication.
Follow the steps below if you want to set user passwords to expire after a specific amount of time.
Only global admins can perform these steps.
In the admin center, go to the Settings > Org Settings.
Go to the Security & privacy page. If you aren't a global admin, you won't see the Security and privacy option.
Select Password expiration policy.
If you don't want users to have to change passwords, select the checkbox next to Set user passwords to expire after a number of days.
Type how often passwords should expire. Choose a number of days from 14 to 730.
In the second box type when users are notified that their password will expire, and then select Save. Choose a number of days from 1 to 30.
When the user's password expires, they'll get a notification that appears in the lower right corner of their screen.
Important things you need to know about the password expiration feature
- People who only use the Outlook app won't be forced to reset their Microsoft 365 password until it expires in the cache. This can be several days after the actual expiration date. There's no workaround for this at the admin level.
Prevent last password from being used again
If you want to prevent your users from recycling old passwords, you can do so by enforcing password history in on-premises Active Directory (AD). See Create a custom password policy.
In Azure AD, The last password can't be used again when the user changes a password. The password policy is applied to all user accounts that are created and managed directly in Azure AD. This password policy can't be modified. See Azure AD password policies.
Synchronize user passwords hashes from an on-premises Active Directory to Azure AD (Microsoft 365)
This article is for setting the expiration policy for cloud-only users (Azure AD). It doesn't apply to hybrid identity users who use password hash sync, pass-through authentication, or on-premises federation like ADFS.
To learn how to synchronize user password hashes from on premises AD to Azure AD, see Implement password hash synchronization with Azure AD Connect sync.
Password policies and account restrictions in Azure Active Directory
You can set more password policies and restrictions in Azure active directory. Check out Password policies and account restrictions in Azure Active Directory for more info.
Update password Policy
The Set-MsolPasswordPolicy cmdlet updates the password policy of a specified domain or tenant. Two settings are required; the first is to indicate the length of time that a password remains valid before it must be changed and the second is to indicate the number of days before the password expiration date that will trigger when users will receive their first notification that their password will soon expire.
To learn how to update password policy for a specific domain or tenant, see Set-MsolPasswordPolicy.