User passwords SHALL NOT expire

Contributed by Michael Soule with 3 co-contributorsAll contributors →

Part of CISA · Entra ID · Password protection · All checks

Run this check

Invoke-Maester -TestId CISA.MS.AAD.6.1

Overview

User passwords SHALL NOT expire.

The National Institute of Standards and Technology (NIST), OMB, and Microsoft have published guidance indicating mandated periodic password changes make user accounts less secure. For example, OMB-22-09 states, “Password policies must not require use of special characters or regular rotation.”

Remediation action

Configure password policies to set passwords to never expire.

1. In Microsoft 365 admin center under Settings and Org settings, select the tab Security & privacy.
2. Under Password expiration policy, set Set passwords to never expire.
3. Click Save.

Related links

• Microsoft 365 admin center - Org settings | Password expiration policy
• Configure the Password expiration policy
• CISA Passwords - MS.AAD.6.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.AAD.6.1
Severity	Medium
Suite	CISA
Product	Entra ID
Related products	Microsoft 365
Feature	Password protection
Area	Authentication
Resource type	Domain
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.6.1
Criticality	SHALL
Upstream requirement	MS.AAD.6.1v1
Supports controls	cisa-scuba:MS.AAD.6.1, nist-800-53-r5:IA-5(1)
PowerShell test	Test-MtCisaPasswordExpiration
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.6.1.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.6.1.md