Microsoft 365 Password Expiration Policy: Why 90-Day Changes Are Outdated

Picture an office manager at a 20-person firm. Her password expires today, so she types the new one in. Her old password was Summer2026!, and the new one is Autumn2026!. It meets every rule: uppercase, number, symbol. It’s also exactly what anyone guessing would try next.

She isn’t careless. She’s doing what the system pushed her to do. Forced rotation and mandatory character rules ask people to create a new, complex, memorable password every few months, and people respond in predictable ways.

For years, a 90-day password change policy was standard advice: “change your password every 90 days.” The guidance behind it has moved on, and many small businesses are still enforcing the old version in their Microsoft 365 password expiration policy. Here’s what changed and what we recommend instead.

Why 90-Day Password Changes Became Standard

The thinking was sound on its face: if a password gets stolen, regular changes limit how long it stays useful. The trouble is what happens in practice. Microsoft’s documentation says research has shown that enforcing frequent password changes or complex symbol requirements can reduce security, because users tend to reuse or simplify their passwords.

NIST makes a related point about composition rules (the “must include a symbol” kind): users respond to them predictably, which is why it advises against imposing them.

The pattern, a small tweak to last quarter’s password, is easy for an attacker to try and easy for a person to repeat across accounts.

What NIST Password Guidelines Recommend

NIST’s Digital Identity Guidelines, SP 800-63B-4, were finalized in mid-2025. They’re written for US federal systems, but they’re widely used as the reference point for good practice. For passwords, the key requirements are:

• No periodic changes. Organizations should not require people to change passwords on a schedule.
• Do change after a compromise. A change must be forced if there’s evidence the password has been compromised.
• No composition rules. Don’t require mixtures of character types.
• Length matters more. A password used alone should be at least 15 characters. Where it’s only one part of multi-factor sign-in, the minimum is 8. Systems should allow passwords of at least 64 characters.
• Block bad passwords. Check new passwords against a list of commonly used, expected, or compromised ones.
• Allow password managers. Systems must allow them and autofill, and should allow pasting.

Microsoft’s Recommended Password Policy for Microsoft 365

Microsoft’s recommended password policy principles for Microsoft Entra ID include:

• A minimum length of 8 characters
• No requirement for specific character composition, such as mandatory symbols
• No forced periodic password changes
• Blocking commonly used or weak passwords
• Not reusing work passwords for non-work accounts

A few practical details from Microsoft’s documentation are worth knowing:

• The default depends on when your tenant was created. For tenants created around spring 2021 or later, the default Microsoft 365 password expiration policy is that passwords never expire. Older tenants may still have a 90-day setting, so it’s worth checking.
• A banned password list is built in. The global list blocks weak passwords like “admin” or “baseball” for every tenant and can’t be turned off. You can also add your own words, such as your company name, to a custom list.
• Hybrid setups are more complicated. If you also run an on-premises Active Directory, its own password policy applies when people sign in to domain-joined computers, so the setting can live in two places.

Canadian Password Security Guidelines for Small Businesses

The Cyber Centre’s password guidance focuses on strength and uniqueness: a passphrase of at least four words and 15 characters, or a password of at least 12 characters, and a different credential for every account. It advises against reusing passwords found in known breaches. Its guidance on credential-stuffing attacks recommends regularly checking for leaked passwords and forcing a change when a leak or malicious activity is detected.

That’s the same idea as NIST’s: change passwords when there’s a reason, not on a calendar.

When Should You Actually Change a Password?

It’s easy to hear this advice as “passwords don’t matter anymore.” That’s not the point. Change a password when:

• You suspect it’s been phished or stolen
• A breach notification includes it
• Someone who knew it leaves (especially for shared accounts)
• An account shows unusual sign-ins
• It was ever shared or written somewhere insecure

The shift is from “change it on schedule” to “change it when there’s a reason, and make the password strong to begin with.”

Microsoft 365 Password Security Best Practices for Small Businesses

• Turn off forced rotation for regular user accounts, once MFA is in place.
• Drop mandatory character-type rules, and encourage length instead. Long passphrases of four random words or 15 characters or more are easier to remember and harder to guess.
• Require MFA everywhere it’s supported, with administrators and finance first. Passkeys are better still where available.
• Use a password manager, so nobody needs to remember dozens of different passwords.
• Block known-bad passwords, using the built-in banned list and a custom list of words specific to your business.
• Change on evidence, not on a calendar, and have a clear process for who decides and how a reset is forced.

How to Change Your Microsoft 365 Password Expiration Policy

1. Find out where the setting lives. It’s the Microsoft 365 password expiration policy setting in the admin center. For synced accounts, check the on-premises password policy too.
2. Put MFA in place first. Don’t relax rotation while accounts are protected by a password alone.
3. Set the new expiration policy. For cloud accounts, that’s usually “never expire,” with any service accounts reviewed separately.
4. Add your custom banned words. Company name, street, local sports teams: the guesses people actually make.
5. Tell your team why. If staff are used to being forced to change passwords, a short note explaining the change and what to do instead (long passphrase, password manager) avoids confusion.
6. Document the decision. Write down what you changed, when, and why.

What to Check Before Changing Your Password Policy

• Contracts, insurers, or regulators. If anyone requires rotation, ask them to show you the requirement before changing the policy. Some questionnaires still assume the old rules, and you may need to explain your reasoning.
• Shared accounts. These are a reason to move to individual accounts, since a shared password is hard to rotate safely or trace.
• Older systems that can only authenticate with a password may need a different plan.

Your 15-Minute Business Password Security Checklist

• Find your current Microsoft 365 password expiration policy setting. What is it?
• Check whether MFA is turned on for every account, administrators first.
• Ask: do we have a password manager, and does everyone use it?
• Write down who decides when a password must be reset after a suspected compromise.
• Look for a shared “Passwords” spreadsheet, and plan to retire it.

Frequently Asked Questions

Should employees change their passwords every 90 days?

Not necessarily. NIST and Microsoft discourage mandatory periodic password changes. Passwords should be changed when there is evidence or suspicion of compromise.

Does Microsoft recommend passwords never expire?

Microsoft recommends against periodic password expiration for cloud-only accounts. However, hybrid environments involving on-premises Active Directory may require additional policy checks.

What is the recommended password length according to NIST?

NIST recommends a minimum of 15 characters when a password is used as the only authentication factor, and at least 8 characters when it is part of multi-factor authentication.

How do I check my Microsoft 365 password expiration policy?

An administrator can review the Microsoft 365 password expiration policy through the Microsoft 365 admin center. Hybrid environments also require checking the relevant on-premises Active Directory policy.

Is Your Business Still Using an Outdated Password Policy?

Your Microsoft 365 password expiration policy may not reflect today’s security recommendations. A2 SecureCloud helps small businesses review their Microsoft 365 security settings, strengthen sign-in protection, and establish practical password policies that protect accounts without creating unnecessary work for employees.

Want to know where your business stands?

Take the assessment

Or email us at info@a2securecloud.ca.

Related guides

• Microsoft 365 authentication changes: SMS codes are retiring, and passkeys are the replacement
• Microsoft 365 employee offboarding: the right order for removing access
• Small business cybersecurity in the age of AI: six practical steps
• IT governance and security policies for small businesses, in plain language
• Business continuity planning: what growing businesses actually need