What is the recommendation for Password policy. If we are using Windows Hello For Business.

Question

Hi Team

We are implementing Windows hello for business. However, we still have option to login using password.

We have password reset policy for 30 days. What is the recommendation for password policy, if we are using Hello for business?

As this is going to be difficult for users to remember password, while it needs to be change after 30days. As users using WHFB. However we have SSPR enabled as well.

If we keep both, that make difficult for users instead making seamless experience for them.

Answer 1

As per https://learn.microsoft.com/en-us/windows/security/identity-protection/passwordless-strategy/journey-step-3

If your organization doesn't have password rotation requirements, it's recommended to disable password age.

If your organization has a password rotation policy, consider implementing automation to rotate the user's password regularly. This approach ensures that the user's password is always randomized and prevents the user from knowing the password.

For more password-related guidance, see the whitepaper Password Guidance.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin