# Microsoft Intune service must enforce a 60-day maximum password lifetime restriction

Passwords expire after 60 days or less on every verified, managed domain. (DISA Microsoft Intune MDM Service Desktop STIG, V-267355, CAT II).

Source: https://maester.dev/docs/tests/DISA.V-267355

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Microsoft 365 · Organization settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-267355 -IncludePreview
```

## Overview

Passwords expire after 60 days or less on every verified, managed domain. (DISA Microsoft Intune MDM Service Desktop STIG, V-267355, CAT II).

Intune sign-ins use Microsoft Entra ID passwords, so the password lifetime is set on the tenant's domains. The Intune STIG asks for 60 days, shorter than the 180 days of the newer Entra ID STIG.

This test runs [DISA.V-270239](https://maester.dev/docs/tests/DISA.V-270239) with a maximum of 60 days (`MaximumPasswordAgeDays`). Like that test, it conflicts with [CIS.M365.1.3.1](https://maester.dev/docs/tests/CIS.M365.1.3.1), which asks that passwords never expire.

#### Remediation action

1. In the [Microsoft 365 admin center](https://admin.microsoft.com), go to **Settings** > **Org settings** > **Security & privacy** > **[Password expiration policy](https://admin.microsoft.com/#/Settings/SecurityPrivacy/:/Settings/L1/PasswordPolicy)**.
2. Clear **Set passwords to never expire (recommended)**, set **Days before passwords expire** to **60** or less, and select **Save**.

#### Related links

* [DISA Microsoft Intune MDM Service Desktop STIG: V-267355](https://cyber.trackr.live/stig/Intune_Service_Desktop/1/1/V-267355)
* [Set the password expiration policy for your organization](https://learn.microsoft.com/microsoft-365/admin/manage/set-password-expiration-policy)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-267355 |
| Severity | Low |
| Suite | DISA |
| Product | Microsoft 365 |
| Related products | Entra ID |
| Feature | Organization settings |
| Area | Authentication |
| Resource type | Domain |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267355 |
| Supports controls | disa-stig-intune-desktop:V-267355, nist-800-53-r5:IA-5(1) |
| PowerShell test | [Test-MtDisaIntuneDesktopPasswordLifetime](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267355.ps1) |
| Services | Graph |
| Lifecycle | Preview |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-267355.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267355.ps1)
- Documentation: [`tests/disa/Test.DISA.V-267355.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-267355.md)