What this check looks at
Checks whether accounts are set never to expire their passwords, in line with current NIST and Microsoft guidance.
Microsoft 365 can force people to change their password every so many days. The period is held on each domain, which the Microsoft 365 admin centre sets for the organisation, and an individual account can be exempted with the DisablePasswordExpiration flag. Older tenants often still carry the 90-day expiry that used to be the default; Microsoft now sets passwords to never expire in new tenants.
The check counts enabled member accounts whose password never expires, either because the account itself is exempt or because its domain is set to never expire. It passes when 95% or more never expire, warns when between half and 95% do (an inconsistent policy), and fails below half. Where the domain policy could not be read for many accounts, it says it could not check rather than guessing.
Forced regular changes do not make passwords stronger. People respond predictably, moving from Spring2026! to Summer2026!, writing the new one down or reusing it elsewhere, and an attacker who has an old password can often guess the next. Expiry also drives a steady stream of lock-outs and reset calls, each one a chance for someone to talk the service desk into a reset.
Why it matters
Forced periodic expiry produces predictable, incrementing passwords and more helpdesk calls without measurably reducing compromise. Current guidance is to disable expiry and rely on MFA plus breached-credential detection.
A practical example: an attacker finds a staff member’s password in the breach of another website. Expiry changed it last month, but only from Winter2025! to Spring2026!, and the attacker tries the obvious next value. Meanwhile the service desk handles a burst of reset calls every quarter, and one caller who is not who they claim gets a reset.
Removing expiry is safe only with compensating controls in place: MFA enforced, banned-password protection (on by default in Entra ID) and leaked-credential detection. With those, a password is changed when there is a reason, such as a known compromise, rather than on a timer, and people pick better passwords because they keep them.
NCSC password guidance advises against forced regular expiry, as do Microsoft and NIST SP 800-63B. The CIS Microsoft 365 Foundations Benchmark (1.3.1) and the CISA SCuBA baseline (MS.AAD.6.1v1) both ask for passwords set never to expire, and the rule maps to NIST CSF 2.0 PR.AA-01.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Security & privacy
Before you start
- Make sure MFA is enforced first: the current guidance from Microsoft and the NCSC is that forced expiry weakens passwords only when there is no second factor.
Step by step
- Make sure MFA is enforced first. Check that the MFA enforcement and legacy authentication findings pass. Without a second factor, a password that never changes is the only defence, so fix MFA before this.
- Set passwords to never expire for the organisation. In the Microsoft 365 admin centre, go to Settings > Org settings > Security & privacy > Password expiration policy. Tick Set passwords to never expire (recommended) and select Save.
- Check every domain with PowerShell. In Microsoft Graph PowerShell (Connect-MgGraph -Scopes Domain.ReadWrite.All), run Get-MgDomain | Select-Object Id, PasswordValidityPeriodInDays. A domain not showing 2147483647 still expires; set it with Update-MgDomain -DomainId contoso.co.uk -PasswordValidityPeriodInDays 2147483647.
- Leave synchronised accounts to Active Directory. Accounts synchronised from on-premises Active Directory follow the on-premises password policy, and Microsoft Entra Connect normally marks them as never expiring in the cloud. If the client agrees, set Maximum password age to 0 in the domain password policy (Group Policy Management, Default Domain Policy, Account Policies > Password Policy) so the two match.
- Tell staff. Let staff know they will no longer be asked to change their password on a schedule, and that they must still change it at once, at https://aka.ms/sspr, if they think it has been exposed.
- Confirm. Reopen Password expiration policy and check the box is ticked, and run Get-MgDomain again to see 2147483647 on every domain. Re-run the assessment; it passes when at least 95% of enabled member accounts never expire.
What users will notice
Users are no longer made to change their password every few months. They still change it if it is compromised.
How to confirm it worked
Microsoft 365 admin centre, Settings, Org settings, Security and privacy, Password expiration policy: "Set passwords to never expire" is ticked.
Frameworks and controls
This check maps to controls in 10 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| Zero Trust | Identities |
| Secure Score | Set the password expiration policy to never expire |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| ISO 27001:2022 | A.5.17 Authentication information |
| CISA SCuBA | MS.AAD.6.1v1 User passwords do not expire |
| CIS M365 | 1.3.1 Ensure the 'Password expiration policy' is set to 'Set passwords to never expire' |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Set password expiration policy (Microsoft Learn)