Password policy

Set the rules new passwords must meet.

Find it at Password Policy

Sets the minimum standard every password must meet when it is created or changed. The rules apply wherever a password is set — by a user resetting their own, by an admin setting one for someone else, and during a bulk import — so there is no route around them.

The settings

Minimum Password Length

How many characters a password must have. The single most effective setting here.

Minimum Capital Letters

How many upper-case letters are required. Zero means none are required.

Minimum Numeric Digits

How many digits are required.

Minimum Special Characters

How many symbols are required.

Auto Reset Password Status

Whether passwords expire on a fixed cadence and must be changed.

Reject Breached Passwords

Refuses any password known to have appeared in a public data breach.

Turn on Reject Breached Passwords

This is the one with the largest effect. Attackers do not guess passwords at random — they try passwords already known from previous breaches. A password that meets every complexity rule is still worthless if it is on those lists, and this check is the only setting here that catches that.

Length beats complexity

A long passphrase is both harder to break and easier to remember than a short one full of symbols. If you are choosing where to be strict, raise the minimum length rather than stacking up character requirements.

Be sparing with expiry

Forcing frequent changes tends to produce predictable variations — Summer2025 becomes Summer2026 — which is weaker than one strong password kept longer. Modern guidance is to expire passwords when you suspect a compromise, not on a calendar.

Existing passwords are not re-checked

Tightening the policy applies to passwords set from that point on. To bring everyone up to the new standard you need them to change their password — that is the one good use of the expiry setting.

Setting the policy

1 Go to Password Policy.
2 Set the minimum length first — it has more effect than the character rules.
3 Turn on Reject Breached Passwords.
4 Save. The rules apply to every password set from that point on.