The password expiration policy in Microsoft 365 dictates whether user passwords expire after a set number of days or remain valid indefinitely. In managed environments, aligning this setting with modern security frameworks (like NIST and Microsoft’s own guidance) is a necessary step to reduce user friction and mitigate the risks of predictable password rotations.
With the Microsoft 365 admin center, you can initialize this configuration centrally from the Org settings module. This guide walks through verifying and modifying the password expiration policy for your tenant.
Why Configure Password Expiration?
Controlling the password lifecycle at the tenant level helps with:
- Modern security alignment: Microsoft and NIST strongly recommend setting passwords to never expire, as forced arbitrary rotations often lead users to choose weaker, incrementally guessable passwords.
- Reduced helpdesk overhead: Eliminating 90-day expiration cycles drastically reduces the volume of password reset tickets and locked-out account scenarios.
- Legacy compliance: If your specific industry regulations still mandate periodic password changes, this setting allows you to enforce a strict expiration threshold (e.g., 60 or 90 days) across the entire directory.
Important: Microsoft’s Latest Guidance (2026)
Microsoft’s current security research strongly indicates that forced password changes are more harmful than beneficial, as they drive users to create weak, predictable passwords or write them down. The recommended setting for cloud-only accounts is for passwords to never expire. Microsoft’s latest guidance explicitly discourages password expiration policies for cloud-only accounts.
The Default Setting Varies by Tenant Age
The default password expiration policy in Microsoft 365 varies depending on when your tenant was created:
| Tenant Age | Default Setting | What This Means |
| Created after 2021 | Passwords set to never expire by default | You likely don’t need to change anything. |
| Created before 2021 | 90-day expiration may be enabled | You may need to manually adjust the setting. |
Most Microsoft 365 Business Premium tenants were created after 2021, so the “never expire” setting is likely already active.
Password Expiration Notifications Are Gone
Microsoft no longer supports password expiration notifications in the Microsoft 365 admin center or in Microsoft 365 productivity apps (Outlook, Word, Excel, etc.). This is a permanent change.
If you choose to enforce password expiration, users will not receive any warning before their password expires. Without notifications, users may only discover their password has expired when they are suddenly locked out, leading to frustrated helpdesk calls. This is one of the primary reasons Microsoft now recommends the “never expire” setting.
Before You Begin: Cloud-Only Users Only
This configuration applies exclusively to cloud-only user accounts.
If your organization uses Microsoft Entra Connect to synchronize users from an on-premises Active Directory, password expiration is controlled by your local Group Policy, not Microsoft 365. Attempting to change this for synced users in the cloud will be overwritten by your on-premises domain controllers.
What You’ll Configure
You will access the Microsoft 365 admin center to navigate to the organizational settings and modify the Security & privacy configuration for passwords.
To perform this action, your account must hold the User Administrator or Global Administrator role. This is a foundational directory feature and is available across all commercial licensing tiers; it requires no premium add-ons and works with basic subscriptions like Microsoft 365 Business Basic, Standard, Premium, and Enterprise plans.
Step 1: Access the Org Settings
- Navigate to the Microsoft 365 admin center and log in with an account that has User Administrator or Global Administrator rights.
- On the left navigation pane, expand Settings (click “Show all” if needed) and click Org settings. (Note: If you don’t see the “Org settings” option, your admin account does not have the required permissions.)
- Click on the Security & privacy tab at the top of the interface.
Step 2: Modify the Expiration Policy
- Select Password expiration policy from the list of available settings.
- To follow modern security best practices, check the box for Set passwords to never expire (recommended).
- If your organization requires rotation (e.g., for regulatory compliance), uncheck the box and specify:
- Days before passwords expire: Choose a number between 14 and 730 days.
- Days before a user is notified about expiration: This setting is ignored. Microsoft has removed expiration notifications. Users will receive no warning before their password expires.
- Click Save to apply the configuration.
Step 3: Verify the Policy via PowerShell
Note: The tenant-level policy applies to all cloud-only users. The following verification checks whether the “never expire” flag is set on individual accounts.
- Open PowerShell 7.x or Windows PowerShell.
- Install the Microsoft Graph module (if not already installed) by running:
Install-Module Microsoft.Graph -Scope CurrentUser- Connect to your tenant with the necessary read permissions:
Connect-MgGraph -Scopes "User.Read.All"A browser window will open. Sign in with your administrator account and consent to the permissions.
- Run the following consolidated script to check password policies. You can uncomment the specific line you need:
# To check a SPECIFIC user's password expiration status:
Get-MgUser -UserId "user@yourdomain.com" -Property UserPrincipalName, PasswordPolicies | Select-Object UserPrincipalName, @{Name="PasswordNeverExpires";Expression={$_.PasswordPolicies -match "DisablePasswordExpiration"}}
# To check ALL users in your tenant:
Get-MgUser -All -Property UserPrincipalName, PasswordPolicies | Select-Object UserPrincipalName, @{Name="PasswordNeverExpires";Expression={$_.PasswordPolicies -match "DisablePasswordExpiration"}}Important PowerShell Note: If the PasswordNeverExpires column shows False and the PasswordPolicies field is completely blank, do not be alarmed. In Microsoft Graph, this property only populates when an explicit override (like DisablePasswordExpiration) is applied to the individual user object. A blank value actually indicates the user is successfully following the default tenant policy (which should be the “never expire” setting if you configured it above).
Step 4: Verify the Policy with a Test User
After saving the policy, test with a cloud-only user account:
- Have the test user sign out of all Microsoft 365 services.
- Wait at least 15–30 minutes for the policy to propagate across all Microsoft 365 services.
- Have the test user sign back in. If the policy is set to “never expire”, they should not receive any password expiration warnings.
- If the policy is set to expire after a certain number of days, the user will only be prompted to change their password on or after the expiration date – but they will receive no advance warning.
What Else You Should Know
| Topic | Important Details |
| Password complexity | Microsoft Entra ID enforces a minimum of 8 characters (Microsoft recommends 14), requiring three out of four character types (uppercase, lowercase, numbers, symbols). This cannot be changed. |
| Password history | Users cannot reuse their previous password when changing passwords. This applies to all cloud-only accounts and cannot be modified. |
| Account lockout | Accounts are locked for 1 minute after 10 unsuccessful sign-in attempts. Lockout duration increases with repeated failed attempts. |
| Backend password aging | Even when “never expire” is set, passwords have an effective maximum age of 730 days due to backend storage limitations. This is entirely transparent to the user, requires no administrative action, and rarely impacts day-to-day operations. |
| Synchronized users (hybrid) | For users synchronized from on-premises Active Directory, the password expiration policy is controlled by your on-premises AD, not by the Microsoft 365 policy. |
| Outlook cache delay | Users who only use the Outlook desktop app may not be forced to reset their password until days after the actual expiration date due to cached authentication. There is no admin-level workaround for this. |
Troubleshooting: Policy Not Applying?
| Symptom | Most Likely Cause | What To Do |
| Users still see expiration warnings after setting “never expire” | Propagation delay or user has individual override | Wait 1 hour. Check individual user settings via PowerShell (see Step 3). |
| Setting doesn’t save or reappears as “expire after 90 days” | Your tenant may be older (pre-2021) with default 90-day expiration | Contact Microsoft Support to check tenant configuration flags. |
| “Password expiration policy” option is missing | Your admin account lacks required permissions | Verify your account has User Administrator or Global Administrator role. |
| Hybrid users not following tenant policy | On-premises AD controls password policy for synced users | Configure password expiration in your on-premises Active Directory, not Microsoft 365. |
Wrap-Up
You can configure the password expiration policy for your Microsoft 365 tenant by accessing the Org settings module in the Microsoft 365 admin center and modifying the Security & privacy parameters. Ensure you hold User Administrator or Global Administrator rights before starting.
Use this configuration to either align with modern non-expiring recommendations or to enforce strict regulatory compliance, providing the essential lifecycle management required for your organizational identities.
Final Recommendation for Business Premium: Microsoft’s latest guidance strongly recommends setting passwords to never expire when combined with Multi-Factor Authentication (MFA). Business Premium includes MFA capabilities, making the “never expire” setting the most secure and user-friendly choice for your organization.
Crucial Compliance Warning: Remember that password expiration notifications are permanently retired. If you must enforce expiration for strict compliance reasons, ensure Self-Service Password Reset (SSPR) is fully enabled and tested for all users to prevent sudden, notification-less user lockouts and helpdesk overload.
