Microsoft Entra ID must enforce a 180-day maximum password lifetime restriction
Part of DISA · Microsoft 365 · Organization settings · All checks
Invoke-Maester -TestId DISA.V-270239 -IncludePreviewOverview
Section titled “Overview”Passwords expire after 180 days or less on every verified, managed domain (DISA Microsoft Entra ID STIG, V-270239, CAT II).
DISA requires a maximum password lifetime, so a password that leaked without anyone noticing stops working after a known time. In Microsoft 365 the password expiration policy is set per domain, and it applies to the verified domains that are managed by Microsoft Entra ID (federated domains follow the identity provider’s policy).
The check fails when a verified, managed domain never expires passwords or sets a lifetime longer than 180 days (MaximumPasswordAgeDays). A domain that stores no period is reported for review, because the API does not say whether the default of 90 days the STIG mentions applies or, as in newer tenants, passwords never expire.
This conflicts with CIS. CIS.M365.1.3.1 reads the same setting and asks that passwords never expire, as NIST SP 800-63B recommends. A tenant can pass only one of the two tests; run the one your organization is assessed against.
Remediation action
Section titled “Remediation action”- In the Microsoft 365 admin center, go to Settings > Org settings > Security & privacy > Password expiration policy.
- Clear Set passwords to never expire (recommended).
- Set Days before passwords expire to 180 or less, and select Save.
The admin center sets the period on every domain. To set one domain, use Update-MgDomain -DomainId <domain> -PasswordValidityPeriodInDays 180.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | DISA.V-270239 |
| Severity | Low |
| Suite | DISA |
| Product | Microsoft 365 |
| Related products | Entra ID |
| Feature | Organization settings |
| Area | Authentication |
| Resource type | Domain |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | DISA Microsoft Entra ID STIG (version V1R2), requirement V-270239 |
| Supports controls | disa-stig-entra-id:V-270239, nist-800-53-r5:IA-5(1) |
| PowerShell test | Test-MtDisaPasswordLifetime |
| Services | Graph |
| Lifecycle | Preview |
Source
Section titled “Source”- Test:
tests/disa/Test.DISA.V-270239.ps1 - Documentation:
tests/disa/Test.DISA.V-270239.md