Entra ID user default password expiration policy

Question

Entra ID user default password expiration policy

Jiang Yitao 50

I have a new tenant created this year. I've read Microsoft docs but it seems very unclear about default password expiration policy.

In this M365 doc: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/set-password-expiration-policy?view=o365-worldwide, it says by default password never expiration.

But in the below Entra ID doc, it also says by default Password Expiry property is set to false (indicates that passwords have an expiration date).

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy

So which is true??

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

FrankEscarosBuechsel-MSFT 905 Microsoft Employee Moderator

Hi @Mobu • Thank you for reaching out.

It looks like you are looking for some clarifications for the password expiry settings.

I have a created a test tenant to illustrate how this works on newer tenants as mentioned in the documentation you are linking to.

User's image

You can see that for the Entra ID directory the password validity is indeed essentially set to an unlimited period, meaning passwords do not expire by default.

This can however be overridden on a per user basis. You can see Update-MgUser for more details on that.

The explanation as to why there is an expiration setting is from the interaction with Entra Domain Services. It is documented in this Learn Article: What is the password lifetime policy on a managed domain?

Additionally, the Microsoft Entra password policy for DisablePasswordExpiration is synchronized to a managed domain. When DisablePasswordExpiration is applied to a user in Microsoft Entra ID, the UserAccountControl value for the synchronized user in the managed domain has DONT_EXPIRE_PASSWORD applied.

For the purposes of a standalone Entra ID configuration, the default is indeed that passwords will not expire if he tenant was created after 2021.

I hope this clarifies as to what this setting does in combination with other services.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

Jiang Yitao 50 Reputation points

2024-12-27T23:08:47.25+00:00

@FrankEscarosBuechsel-MSFT Hi, thank you for answering my question.

I found that per-user password policy value is set to null by default. In the combination of per-user to null & password validity to an unlimited period, the user password also does not expire, is that correct? So this means, as long as domain level password validity value is an unlimited period, no matter per-user password policy is null or DisablePasswordExpiration, for all users in this domain, password will not expire. Is my understanding correct?
FrankEscarosBuechsel-MSFT 905 Reputation points Microsoft Employee Moderator

2025-01-06T10:45:30.9733333+00:00

Hi @Mobu, Happy New Year!

Your understanding is correct, unless you specifically overwrite the expiry the passwords are not going to expire indeed.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.
FrankEscarosBuechsel-MSFT 905 Reputation points Microsoft Employee Moderator

2025-01-07T13:27:02.81+00:00

Hi @Mobu

Just checking in to see if you had a chance to see above. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.  And, if you have any further questions do let us know.