(52) Microsoft 365 - Set Password to Expire or Never Expire

Microsoft recommends to set the Microsoft 365 password expiration policy to never expire because password expiration requirements do more harm than good. Think about it, users get a message or notification to change their password. They add a number or symbol behind the existing password and set it as a new password.

Set Password to Never Expire

1. Navigate to https://admin.microsoft.com/ then expand Setttings then select Org settings.

2. Select Security & Privacy tab, then select Password expiration policy.

3. Ensure to tick "Set passwords to never expire" then save changes.

4. To ensure that it applies to the rest of your organisation, run PowerShell as admin.

Enter your credentials:

Connect-AzureAD

To check if Password Never Expires is set:

Get-AzureADUser -ObjectId bmah@soeintunedevice.onmicrosoft.com | Select-Object UserprincipalName,@{

N="PasswordNeverExpires";E={$_.PasswordPolicies -contains "DisablePasswordExpiration"}

}

To see a list of users, run the following

Get-AzureADUser -All $true | Select-Object UserprincipalName,@{

N="PasswordNeverExpires";E={$_.PasswordPolicies -contains "DisablePasswordExpiration"}

}

To set a password never expire for a single user, run the following:

Set-AzureADUser -ObjectId <user ID> -PasswordPolicies DisablePasswordExpiration

To set a password to never expire for all users, run the following:

Get-AzureADUser -All $true | Set-AzureADUser -PasswordPolicies DisablePasswordExpiration

Then run the following to check if that been applied, by running the following:

Get-AzureADUser -All $true | Select-Object UserprincipalName,@{

N="PasswordNeverExpires";E={$_.PasswordPolicies -contains "DisablePasswordExpiration"}

}

To set a pasword to expire for a single user, run the following:

Set-AzureADUser -ObjectId <user ID> -PasswordPolicies None

To set the password for all users to expire, run the following:

Get-AzureADUser -All $true | Set-AzureADUser -PasswordPolicies None