# Password expiration is disabled When password expiration policies remain enabled, threat actors can exploit the predictable password rotation patterns that users typically follow when… Source: https://maester.dev/docs/tests/ZTA.21811 :::note[Maester checks this too] [CISA.MS.AAD.6.1](/docs/tests/CISA.MS.AAD.6.1) (User passwords SHALL NOT expire.) checks the same setting. Running both reports it twice. ::: ## Overview When password expiration policies remain enabled, threat actors can exploit the predictable password rotation patterns that users typically follow when forced to change passwords regularly. Users frequently create weaker passwords by making minimal modifications to existing ones, such as incrementing numbers or adding sequential characters. Threat actors can easily anticipate and exploit these types of changes through credential stuffing attacks or targeted password spraying campaigns. These predictable patterns enable threat actors to establish persistence through: - Compromised credentials - Escalated privileges by targeting administrative accounts with weak rotated passwords - Maintaining long-term access by predicting future password variations Research shows that users create weaker, more predictable passwords when they are forced to expire. These predictable passwords are easier for experienced attackers to crack, as they often make simple modifications to existing passwords rather than creating entirely new, strong passwords. Additionally, when users are required to frequently change passwords, they might resort to insecure practices such as writing down passwords or storing them in easily accessible locations, creating more attack vectors for threat actors to exploit during physical reconnaissance or social engineering campaigns. ## Remediation - [Set the password expiration policy for your organization](https://learn.microsoft.com/microsoft-365/admin/manage/set-password-expiration-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci). - Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com/). Go to **Settings** > **Org Settings** >** Security & Privacy** > **Password expiration policy**. Ensure the **Set passwords to never expire** setting is checked. - [Disable password expiration using Microsoft Graph](https://learn.microsoft.com/graph/api/domain-update?view=graph-rest-1.0&preserve-view=true&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci). - [Set individual user passwords to never expire using Microsoft Graph PowerShell](https://learn.microsoft.com/microsoft-365/admin/add-users/set-password-to-never-expire?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) - `Update-MgUser -UserId -PasswordPolicies DisablePasswordExpiration` ## Run it The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed: ```powershell Install-Module ZeroTrustAssessment -Scope CurrentUser Connect-Maester Invoke-Maester -Pack ZTA -SkipBuiltIn ``` Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.

About this check

| | | | --- | --- | | Severity | Medium | | Effort to fix | Low | | Impact on users | Low | | Pillar | Identity | | Category | Credential management | | Product | [Entra ID](/docs/tests/products/entra) | | Feature | Password protection | | Area | Authentication | | ATT&CK | [T1110](/docs/tests?mitre=T1110) Brute Force | | Licence | P1 | | Tenant | Workforce, External | Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.