Need to set minimum 12-character password policy for Entra ID P1 license, where we have cloud only users. By default, we have minimum of 8-character password which does not meet the Organization standard and considered to be a weak password policy.

Question

Need to set minimum 12-character password policy for Entra ID P1 license, where we have cloud only users. By default, we have minimum of 8-character password which does not meet the Organization standard and considered to be a weak password policy.

Madhusoodhan Gopal 95

Hi,

Our organization have license with Microsoft Entra ID P1, and all the users inside it, are prompted to reset their password with minimum 8-character password. But as per our security standards we require users to set passwords with minimum 12-character password. Please help in how we set a policy where we can change from 8-character minimum password to 12-character lengthy passwords. Note: We have cloud-only users, and we don't have any on-premises AD or Server.Passwrd Policy.PNG

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2023-12-04T05:17:05.1366667+00:00

Hi @Madhusoodhan Gopal ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-12-05T20:29:59.18+00:00

@Madhusoodhan Gopal

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Runtime34 30 Reputation points

2024-10-07T15:51:49.58+00:00

Hello Microsoft Employees - I believe you would know that the answer "Not possible to change minimum 8 character passwords in Entra ID/Cloud only environments" is acceptable.

We're not going to click "Accept Answer" until you provide the ability to customize min password length in Azure. 8 characters isn't even your recommended policy. We're leaving AD On-Prem/Hybrid environments as I write this - so controlling password length is critical.

To the Community - is our only option leaning on 3rd party SSO/federation vendor solutions? Can they control a user password overwrite from Entra's 8 character policy? Basically block the use at the SSO identity level? Thank you all who will take time to educate. Microsoft - do better than stating the obvious and not providing a solution.
Storm Søndergaard 35 Reputation points

2024-11-08T15:14:13.6066667+00:00

It's absolutely unacceptable that this basic security feature still isn’t available after so many years. The fact that we can’t enforce a minimum password length greater than 8 characters is a serious oversight and a huge compliance risk for organizations. For instance, NIST's SP 800-63B clearly recommends a minimum password length of at least 12 characters, and ISO 27001 also emphasizes robust password management as part of information security controls.

How can we be expected to trust you with sensitive data when it lacks even the most basic capabilities to meet industry standards? Why is it so difficult to implement a setting that has been a core requirement in many compliance frameworks for years?

This is not just inconvenient—it's a direct violation of best practices and puts businesses in jeopardy of failing audits and compliance checks. It’s time Microsoft actually listens to its users and prioritizes security instead of constantly pushing back the most basic security policies.

Fix this now.
Karl 15 Reputation points

2024-11-19T18:10:08.4566667+00:00

Agreed! This seems to be ridiculous.
Trent M 5 Reputation points

2024-11-28T02:44:22.1233333+00:00

How is "this isn't supported" still an acceptable answer? Given you can set minimum passwords in InTune, I naively assumed the same would be possible in Entra...

How do we escalate this?
Are 15 Reputation points

2024-12-13T09:06:53.0966667+00:00

This needs to happen ASAP. We need to implement a minimum password length well in excess of 8.
This short of a password hasn't beeen acceptable since never. Please escalate this.
Derek Hart 25 Reputation points

2025-01-13T14:28:21.7066667+00:00

It is bizarre in 2025 that you cannot enforce a longer password in Entra.

Come on Microsoft, please resolve.
David Griffith 10 Reputation points

2025-01-13T15:31:35+00:00

This needs to be actioned immediately, 8 character passwords can be brute forced in seconds at this stage. @Microsoft - get you finger out!!
Derek Hart 25 Reputation points

2025-01-14T10:30:07.0666667+00:00

You can vote for this feature and request other features using the link below (they have stopped using old feature request site):

https://feedbackportal.microsoft.com/feedback/

I have found an existing post on this item so can everyone who is interested in this feature maybe vote for this item or if you want add a new one - find other similar ones and vote for them etc:

https://feedbackportal.microsoft.com/feedback/idea/00aa2edc-374f-ef11-b4ad-000d3a0e6a3a
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Christopher Powell 0 Reputation points

2025-02-12T01:41:22.75+00:00

New 2025 FBI/CJIS requirements are a minimum 20 character passcode with MFA. Using Entra ID as a federated SSO with CJIS systems. We will need a new solution if we can’t increase minimum length. You need to catch Microsoft.
Chris Flanders 0 Reputation points

2025-02-27T21:27:35.7666667+00:00

Escalate please. It is 2025 and 8 character password minimums were a thing 20 years ago...
Fred 40 Reputation points

2025-03-10T17:50:12.46+00:00

Changing minimum password length in cloud only solutions needs to be a thing. Please work this
David C 25 Reputation points

2025-03-13T17:28:41.0466667+00:00

Agreed, we need to be able to set minimum password length to greater than 8 characters in Entra ASAP. It is surprising this setting isn't already available. As others have mentioned, we need to be able to set the minimum length to 12, 14, 20 or even more characters. Please address this ASAP Microsoft. Thank you.
David Griffith 10 Reputation points

2025-03-14T10:35:27.2033333+00:00

I agree with John Holmes, I have also verified that this is not possible without on-prem AD which many of us are trying to move away from, but we have no option to set minimum password requirements. This is a massive issue for compliance which is a very hot topic at the moment.

@Microsoft, can you please change this!?!!
Ervín Bottyán 0 Reputation points

2025-03-25T09:01:31.3+00:00

Hello MS

Has there been any progress on this topic? PCI DSS 4.0.1 requirement 8.3.6 mandates a minimum password length of 12 characters, but Entra ID does not provide an option to enforce this rule. Additionally, Microsoft's responsibility matrix delegates this requirement to its customers.

Thanks a lot
RODRIGUEZ TORRES Daniel 0 Reputation points

2025-04-08T15:21:35.03+00:00

I don't understand why it's not parameterizable. This is incomprehensible.

2 answers

Your answer

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2023-12-04T05:17:05.1366667+00:00

Hi @Madhusoodhan Gopal ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-12-05T20:29:59.18+00:00

@Madhusoodhan Gopal

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Runtime34 30 Reputation points

2024-10-07T15:51:49.58+00:00

Hello Microsoft Employees - I believe you would know that the answer "Not possible to change minimum 8 character passwords in Entra ID/Cloud only environments" is acceptable.

We're not going to click "Accept Answer" until you provide the ability to customize min password length in Azure. 8 characters isn't even your recommended policy. We're leaving AD On-Prem/Hybrid environments as I write this - so controlling password length is critical.

To the Community - is our only option leaning on 3rd party SSO/federation vendor solutions? Can they control a user password overwrite from Entra's 8 character policy? Basically block the use at the SSO identity level? Thank you all who will take time to educate. Microsoft - do better than stating the obvious and not providing a solution.
Storm Søndergaard 35 Reputation points

2024-11-08T15:14:13.6066667+00:00

It's absolutely unacceptable that this basic security feature still isn’t available after so many years. The fact that we can’t enforce a minimum password length greater than 8 characters is a serious oversight and a huge compliance risk for organizations. For instance, NIST's SP 800-63B clearly recommends a minimum password length of at least 12 characters, and ISO 27001 also emphasizes robust password management as part of information security controls.

How can we be expected to trust you with sensitive data when it lacks even the most basic capabilities to meet industry standards? Why is it so difficult to implement a setting that has been a core requirement in many compliance frameworks for years?

This is not just inconvenient—it's a direct violation of best practices and puts businesses in jeopardy of failing audits and compliance checks. It’s time Microsoft actually listens to its users and prioritizes security instead of constantly pushing back the most basic security policies.

Fix this now.
Karl 15 Reputation points

2024-11-19T18:10:08.4566667+00:00

Agreed! This seems to be ridiculous.
Trent M 5 Reputation points

2024-11-28T02:44:22.1233333+00:00

How is "this isn't supported" still an acceptable answer? Given you can set minimum passwords in InTune, I naively assumed the same would be possible in Entra...

How do we escalate this?
Are 15 Reputation points

2024-12-13T09:06:53.0966667+00:00

This needs to happen ASAP. We need to implement a minimum password length well in excess of 8.
This short of a password hasn't beeen acceptable since never. Please escalate this.
Derek Hart 25 Reputation points

2025-01-13T14:28:21.7066667+00:00

It is bizarre in 2025 that you cannot enforce a longer password in Entra.

Come on Microsoft, please resolve.
David Griffith 10 Reputation points

2025-01-13T15:31:35+00:00

This needs to be actioned immediately, 8 character passwords can be brute forced in seconds at this stage. @Microsoft - get you finger out!!
Derek Hart 25 Reputation points

2025-01-14T10:30:07.0666667+00:00

You can vote for this feature and request other features using the link below (they have stopped using old feature request site):

https://feedbackportal.microsoft.com/feedback/

I have found an existing post on this item so can everyone who is interested in this feature maybe vote for this item or if you want add a new one - find other similar ones and vote for them etc:

https://feedbackportal.microsoft.com/feedback/idea/00aa2edc-374f-ef11-b4ad-000d3a0e6a3a
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Christopher Powell 0 Reputation points

2025-02-12T01:41:22.75+00:00

New 2025 FBI/CJIS requirements are a minimum 20 character passcode with MFA. Using Entra ID as a federated SSO with CJIS systems. We will need a new solution if we can’t increase minimum length. You need to catch Microsoft.
Chris Flanders 0 Reputation points

2025-02-27T21:27:35.7666667+00:00

Escalate please. It is 2025 and 8 character password minimums were a thing 20 years ago...
Fred 40 Reputation points

2025-03-10T17:50:12.46+00:00

Changing minimum password length in cloud only solutions needs to be a thing. Please work this
David C 25 Reputation points

2025-03-13T17:28:41.0466667+00:00

Agreed, we need to be able to set minimum password length to greater than 8 characters in Entra ASAP. It is surprising this setting isn't already available. As others have mentioned, we need to be able to set the minimum length to 12, 14, 20 or even more characters. Please address this ASAP Microsoft. Thank you.
David Griffith 10 Reputation points

2025-03-14T10:35:27.2033333+00:00

I agree with John Holmes, I have also verified that this is not possible without on-prem AD which many of us are trying to move away from, but we have no option to set minimum password requirements. This is a massive issue for compliance which is a very hot topic at the moment.

@Microsoft, can you please change this!?!!
Ervín Bottyán 0 Reputation points

2025-03-25T09:01:31.3+00:00

Hello MS

Has there been any progress on this topic? PCI DSS 4.0.1 requirement 8.3.6 mandates a minimum password length of 12 characters, but Entra ID does not provide an option to enforce this rule. Additionally, Microsoft's responsibility matrix delegates this requirement to its customers.

Thanks a lot
RODRIGUEZ TORRES Daniel 0 Reputation points

2025-04-08T15:21:35.03+00:00

I don't understand why it's not parameterizable. This is incomprehensible.

Answer 1

JM 1,166

It's currently not possible to change the minimum 8-character password policy for users on Cloud Only Entra Environment. Read More about it here: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy#microsoft-entra-password-policies

Password restrictions	A minimum of 8 characters and a maximum of 256 characters.Requires three out of four of the following types of characters:- Lowercase characters- Uppercase characters- Numbers (0-9)- Symbols (see the previous password restrictions)

Password expiry duration (Maximum password age)	Default value: 90 days. If the tenant was created after 2021, it has no default expiration value. You can check the current policy with Get-MsolPasswordPolicy.The value is configurable by using the Set-MsolPasswordPolicy cmdlet from the Azure AD module for PowerShell.

---If the response is helpful, please click "Accept Answer" and upvote it.---

Madhusoodhan Gopal 95 Reputation points

2023-11-30T13:46:49.64+00:00

Hi,

So how do we implement Custom password policy? Are there any Entra Plans or License that we can buy, or we need only On-premises Server for this kind of policies.
JM 1,166 Reputation points

2023-11-30T13:57:01.6+00:00
There is no license or feature to enable modification of minimum password length. It will be best to raise this with Microsoft directly via their Support channels to see if there are any plans to improve this in the future.

On your other question:

As a prereq. you will need this:

A Microsoft Entra Domain Services managed domain enabled and configured in your Microsoft Entra tenant.

For more info, refer to: https://learn.microsoft.com/en-us/entra/identity/domain-services/password-policy#before-you-begin

Not sure how this will help as your tenant is currently Cloud Only.
JM 1,166 Reputation points

2023-12-02T07:46:34.8566667+00:00

Hi Madhusoodhan, Please advise if the provided answers have helped resolve your query. Feel free to let me know if there are any further questions on this matter. Kindly consider accepting the answer to assist others in the community who may have the same query. Thank you for your cooperation.
Derek Hart 25 Reputation points

2025-01-14T10:30:46.8566667+00:00

You can vote for this feature and request other features using the link below (they have stopped using old feature request site):

https://feedbackportal.microsoft.com/feedback/

I have found an existing post on this item so can everyone who is interested in this feature maybe vote for this item or if you want add a new one - find other similar ones and vote for them etc:

https://feedbackportal.microsoft.com/feedback/idea/00aa2edc-374f-ef11-b4ad-000d3a0e6a3a

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

2 deleted comments

Comments have been turned off. Learn more

Share via

Need to set minimum 12-character password policy for Entra ID P1 license, where we have cloud only users. By default, we have minimum of 8-character password which does not meet the Organization standard and considered to be a weak password policy.

2 answers

Your answer