8 characters or more, some special, throw some numbers in there, and rotate often.
Pretty much the standard advice for creating passwords for as long as computer systems have existed. I want to talk about why this logic isn’t important anymore, providing you’ve got other controls and training in place.
In Active Directory, the Default Domain Group Policy Object will have a password policy with the following settings:
How many of you look at that now and wince a bit?
In Entra ID (formerly Azure Active Directory) the standards are:
Slightly better, but still not what good looks like.
While this has been “best practice” for many years, too much of the focus today is still on how the actual password is composed, rather than adopting multi-factor authentication and Self-Service Password Reset.
Many organisations out there today will have highly specific requirements: some might want 12 characters minimum, others encourage passphrases, and if you’re really unlucky, ridiculously short expiry times.
As Gabe Newell demonstrated with the introduction of Steam Guard over 10 years ago, it’s the MFA element that protects him.
Our industry has not yet caught up with this idea, hence the slew of external regulators and insurers demanding standards that they haven’t questioned or revised recently.
If Entra ID is your identity provider:
*There are legitimate exceptions to make in Conditional Access, but they are not to be made for end-users (Your C-Levels are just like everybody else).
…There are other CA policies I’d recommend, but that isn’t for this post.
Conditional Access Policy
Pretty straightforward, although if you’ve never implemented this before, mit ight be best to use “report-only” for a week or two.
Disabling Password Expiry
This option is over at https://admin.microsoft.com –> Org Settings –> Security & Privacy
Assuming you’ve made the migration to Entra ID Authentication Methods, you’ll have a few options to choose from for users to use to reset their own passwords without calling the helpdesk:
(Eventually, Security Questions will be available too, although some of those are pretty weak. I recently saw a custom one added, which was: “What is your favourite colour?”)
I always recommend requiring two of the above methods for a password reset.
Once configured, users will be able to add methods for SSPR over at https://aka.ms/mfasetup
It’s all well and good being the sysadmin creating these strong policies, but you also need to tell people about them. Number-matching MFA has done a lot to prevent mistakes of people approving prompts without thinking; however, users need to be informed about the new login experience.
For example, tell them:
A big mistake we often make as technical people is forgetting that the things we think are simple are just as obvious to everyone else in the company.
Take a look at the end-user templates and guidance Microsoft provides to give you some comms inspiration.
Looking to improve your organisation’s cloud security posture?
Our award-winning Microsoft cloud and cyber security specialists can help you implement stronger, more effective policies across your M365 estate.
Want to know more? Get in touch today
