Password expiration is disabled

Maester checks this too

CISA.MS.AAD.6.1 (User passwords SHALL NOT expire.) checks the same setting. Running both reports it twice.

Overview

When password expiration policies remain enabled, threat actors can exploit the predictable password rotation patterns that users typically follow when forced to change passwords regularly. Users frequently create weaker passwords by making minimal modifications to existing ones, such as incrementing numbers or adding sequential characters. Threat actors can easily anticipate and exploit these types of changes through credential stuffing attacks or targeted password spraying campaigns. These predictable patterns enable threat actors to establish persistence through:

• Compromised credentials
• Escalated privileges by targeting administrative accounts with weak rotated passwords
• Maintaining long-term access by predicting future password variations

Research shows that users create weaker, more predictable passwords when they are forced to expire. These predictable passwords are easier for experienced attackers to crack, as they often make simple modifications to existing passwords rather than creating entirely new, strong passwords. Additionally, when users are required to frequently change passwords, they might resort to insecure practices such as writing down passwords or storing them in easily accessible locations, creating more attack vectors for threat actors to exploit during physical reconnaissance or social engineering campaigns.

Remediation

• Set the password expiration policy for your organization.
  • Sign in to the Microsoft 365 admin center. Go to Settings > Org Settings >** Security & Privacy** > Password expiration policy. Ensure the Set passwords to never expire setting is checked.
• Disable password expiration using Microsoft Graph.
• Set individual user passwords to never expire using Microsoft Graph PowerShell
  • Update-MgUser -UserId <UserID> -PasswordPolicies DisablePasswordExpiration

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Low
Pillar	Identity
Category	Credential management
Product	Entra ID
Feature	Password protection
Area	Authentication
ATT&CK	T1110 Brute Force
Licence	P1
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.