Microsoft Intune service must enforce a 60-day maximum password lifetime restriction

Contributed by Merill FernandoAll contributors →

Part of DISA · Microsoft 365 · Organization settings · All checks

Run this check

Invoke-Maester -TestId DISA.V-267355 -IncludePreview

Overview

Passwords expire after 60 days or less on every verified, managed domain. (DISA Microsoft Intune MDM Service Desktop STIG, V-267355, CAT II).

Intune sign-ins use Microsoft Entra ID passwords, so the password lifetime is set on the tenant’s domains. The Intune STIG asks for 60 days, shorter than the 180 days of the newer Entra ID STIG.

This test runs DISA.V-270239 with a maximum of 60 days (MaximumPasswordAgeDays). Like that test, it conflicts with CIS.M365.1.3.1, which asks that passwords never expire.

Remediation action

1. In the Microsoft 365 admin center, go to Settings > Org settings > Security & privacy > Password expiration policy.
2. Clear Set passwords to never expire (recommended), set Days before passwords expire to 60 or less, and select Save.

Related links

• DISA Microsoft Intune MDM Service Desktop STIG: V-267355
• Set the password expiration policy for your organization

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-267355
Severity	Low
Suite	DISA
Product	Microsoft 365
Related products	Entra ID
Feature	Organization settings
Area	Authentication
Resource type	Domain
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts
Supports benchmark	DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267355
Supports controls	disa-stig-intune-desktop:V-267355, nist-800-53-r5:IA-5(1)
PowerShell test	Test-MtDisaIntuneDesktopPasswordLifetime
Services	Graph
Lifecycle	Preview

Source

• Test: tests/disa/Test.DISA.V-267355.ps1
• Documentation: tests/disa/Test.DISA.V-267355.md