Your password doesn’t meet the complexity requirements.

8 characters or more, some special, throw some numbers in there, and rotate often.

Pretty much the standard advice for creating passwords for as long as computer systems have existed. I want to talk about why this logic isn’t important anymore, providing you’ve got other controls and training in place.

Microsoft Defaults

In Active Directory, the Default Domain Group Policy Object will have a password policy with the following settings:

• Enforce password history: 24
• Maximum password age: 42 days
• Minimum password age: 1 day
• Minimum password length: 7
• Complexity requirements: Enabled

How many of you look at that now and wince a bit?

In Entra ID (formerly Azure Active Directory) the standards are:

• Enforce password history: 1
• Maximum password age: 90 days
• Minimum password age: 0 days
• Minimum password length: 8
• Complexity requirements: Enabled

Slightly better, but still not what good looks like.

While this has been “best practice” for many years, too much of the focus today is still on how the actual password is composed, rather than adopting multi-factor authentication and Self-Service Password Reset.

Many organisations out there today will have highly specific requirements: some might want 12 characters minimum, others encourage passphrases, and if you’re really unlucky, ridiculously short expiry times.

Passwords aren’t the important bit anymore

As Gabe Newell demonstrated with the introduction of Steam Guard over 10 years ago, it’s the MFA element that protects him.

Our industry has not yet caught up with this idea, hence the slew of external regulators and insurers demanding standards that they haven’t questioned or revised recently.

What you should be doing

If Entra ID is your identity provider:

• Leave the default password creation policy as it is – go configure a banned password list if you really want to
• Create a Conditional Access policy to enforce MFA for All Cloud Apps for All Users*
• Disable password expiry from the M365 Admin Portal
• Configure Self-Service Password Reset and target it to ALL USERS

*There are legitimate exceptions to make in Conditional Access, but they are not to be made for end-users (Your C-Levels are just like everybody else).

…There are other CA policies I’d recommend, but that isn’t for this post.

Expanding on those suggestions

Conditional Access Policy

Pretty straightforward, although if you’ve never implemented this before, mit ight be best to use “report-only” for a week or two.

Disabling Password Expiry

This option is over at https://admin.microsoft.com –> Org Settings –> Security & Privacy

SELF-SERVICE PASSWORD RESET

Assuming you’ve made the migration to Entra ID Authentication Methods, you’ll have a few options to choose from for users to use to reset their own passwords without calling the helpdesk:

• Microsoft Authenticator
• SMS
• Third-party software OATH tokens
• Voice call
• Email OTP

(Eventually, Security Questions will be available too, although some of those are pretty weak. I recently saw a custom one added, which was: “What is your favourite colour?”)

I always recommend requiring two of the above methods for a password reset.

Once configured, users will be able to add methods for SSPR over at https://aka.ms/mfasetup

End-users

It’s all well and good being the sysadmin creating these strong policies, but you also need to tell people about them. Number-matching MFA has done a lot to prevent mistakes of people approving prompts without thinking; however, users need to be informed about the new login experience.

For example, tell them:

• Don’t approve or proceed with anything you aren’t expecting
• Go to https://aka.ms/mfasetup and register some alternate methods
• Make use of the self-service options available to you when the time comes

A big mistake we often make as technical people is forgetting that the things we think are simple are just as obvious to everyone else in the company.

Take a look at the end-user templates and guidance Microsoft provides to give you some comms inspiration.

---

Looking to improve your organisation’s cloud security posture?

Our award-winning Microsoft cloud and cyber security specialists can help you implement stronger, more effective policies across your M365 estate.

Want to know more? Get in touch today