Password Policy Template for Microsoft 365 and Entra, Checked Against NIST SP 800-63B Revision 4

The short version: A good password policy today is short and strict about the right things: long passwords, a block on known-bad passwords, multi-factor authentication, and no forced password changes unless there is evidence of compromise. NIST SP 800-63B Revision 4 and Microsoft's own guidance for Microsoft 365 both point this way. Below is a template you can paste into your policy document, with the Entra and Microsoft 365 setting that backs each line.

This is for owners, finance heads and IT leads who have to write or refresh the company password policy and then make Microsoft 365 enforce it. You will leave with a template, the exact admin steps and PowerShell, and a list of places where Microsoft 365 cannot enforce the ideal wording.

Checked against Microsoft Learn on 28 October 2026. For NIST, we read SP 800-63B Revision 4 (dated 26 August 2025) at pages.nist.gov/800-63-4/sp800-63b.html on the same day.

What NIST SP 800-63B Revision 4 says about passwords

This is not a compliance statement; it is a summary of what the standard says. We summarise only the points that change what you write. Section wording is from the Revision 4 text.

1. Length: passwords used as the only authentication factor must be at least 15 characters. Passwords used only as part of multi-factor authentication may be shorter, but at least 8 characters.
2. Maximum length: systems should allow at least 64 characters.
3. Composition rules: systems must not impose rules such as mixing character types.
4. Expiry: the standard says verifiers must not require periodic changes, and must force a change if there is evidence the password is compromised.
5. Blocklist: a new password must be compared with a list of commonly used, expected or compromised passwords.
6. Usability: systems should allow paste, so password managers work, and should accept Unicode characters.

NIST: verifiers "SHALL NOT require subscribers to change passwords periodically."

The policy template

Copy this into your policy document and edit the bracketed items.

1. Scope: this policy applies to all staff, contractors and service providers who sign in to [Company] systems.
2. Minimum length: passwords must be at least [14] characters. Passwords used without multi-factor authentication must be at least 15 characters. (Because item 7 requires MFA wherever it is supported, this 15-character line applies only to accounts that cannot use MFA.)
3. Passphrases: staff are encouraged to use a long passphrase of several unrelated words. Passwords up to at least 64 characters must be accepted.
4. No composition rules: we do not require symbols, capitals or numbers, because such rules push people to predictable patterns.
5. Blocked passwords: passwords on the common-password list, and passwords containing [Company], product names or office names, are not allowed.
6. No scheduled expiry: passwords do not expire on a timetable. A password must be changed at once if it is suspected or known to be compromised.
7. Multi-factor authentication: every account that supports it must use MFA. Passwords are never the only protection for email, VPN or admin access.
8. No reuse: staff must not use a company password for any other site or service.
9. Password managers: staff may use the company-approved password manager and may paste passwords into sign-in fields.
10. Sharing: passwords are never shared by email, chat or paper. Shared accounts need an approved vault.
11. Lockout and reset: repeated wrong attempts lock the account for a short period. Users reset their own passwords through self-service password reset after identity verification.
12. Privileged accounts: administrators use a separate admin account with MFA and never use it for email or browsing.
13. Incident handling: staff report suspected compromise to [IT contact] immediately. IT resets the password, revokes sessions and reviews sign-in logs.
14. Review: this policy is reviewed every [12] months.

What Microsoft 365 can and cannot enforce

Microsoft Learn states that cloud-only Microsoft 365 accounts have a predefined password policy that cannot be changed. The only items you can change are how many days until a password expires and whether passwords expire at all. That produces four gaps against the template:

1. Complexity: the Entra password policy requires three of four character types (lowercase, uppercase, numbers, symbols), with a minimum of 8 and a maximum of 256 characters. You cannot switch this off. NIST says not to impose composition rules, so the template line is a goal you meet through guidance and MFA.
2. Length: Microsoft's own recommendation is a 14-character minimum, even though Microsoft 365 itself requires at least 8. Close the gap with user guidance, the custom banned list and MFA.
3. Expiry: Microsoft's latest guidance discourages expiry policies for cloud-only accounts and recommends passwords never expire. The default for tenants is no expiration, but a tenant created before 2021 has a 90-day value by default.
4. Unicode: NIST says verifiers should accept Unicode characters, but Learn lists Unicode characters as not allowed in Entra passwords.

Synced accounts differ: by default only passwords for accounts not synchronized through Microsoft Entra Connect can be set not to expire.

Matching Microsoft 365 and Entra settings

1. Block weak and company-specific passwords

Microsoft Entra ID already has a global banned password list. To add your own terms:

1. Sign in to the Microsoft Entra admin center as at least Authentication Policy Administrator.
2. Go to Entra ID > Authentication methods > Password protection.
3. Set Enforce custom list to Yes.
4. Add one term per line: company name, product names, office locations, internal abbreviations. The list takes up to 1,000 terms of 4 to 16 characters, ignores case and covers common substitutions such as "o" and "0".
5. Select Save. Changes can take several hours to apply.

The custom list needs at least a Microsoft Entra ID P1 licence.

2. Stop scheduled expiry

Check who is still on expiry, then set passwords to never expire, as a User Administrator or higher. Pilot with one user first.

Connect-MgGraph -Scopes "User.ReadWrite.All","Domain.Read.All"
# Who has "never expires" today
Get-MgUser -All -Property UserPrincipalName, PasswordPolicies |
  Select-Object UserPrincipalName,
  @{N="PasswordNeverExpires";E={$_.PasswordPolicies -contains "DisablePasswordExpiration"}}
# Set one user, then all users
Update-MgUser -UserId <user ID> -PasswordPolicies DisablePasswordExpiration
Get-MgUser -All | ForEach-Object { Update-MgUser -UserId $_.Id -PasswordPolicies DisablePasswordExpiration }

Run Get-MgDomain | Format-List and read PasswordValidityPeriodInDays to see the tenant-level setting (the example output on Learn shows 2147483647 for a domain without expiry). This needs the Domain.Read.All permission, which is why the scopes above include it. The command that sets all users will return errors for synced accounts, which cannot be set this way by default. Passwords set this way still age by the LastPasswordChangeDateTime attribute. If you later switch back to expiry, everyone whose last change is older than 90 days must change at next sign-in.

3. Require MFA

Follow our step-by-step guide to turning on MFA in Microsoft 365, then the six baseline Conditional Access policies. For a worked rollout, see the MFA rollout for a Hong Kong accounting firm.

4. Lockout and self-service reset

By default, an account locks out after 10 wrong passwords, for one minute, and the lockout time grows after further failures. Smart lockout does not count repeats of the same wrong password. You can set the threshold and duration. Administrator accounts are enabled for self-service password reset with a two-gate policy that cannot be changed and prohibits security questions.

Common mistakes

1. Keeping 90-day expiry "to be safe." Both NIST and Microsoft advise against scheduled expiry, and Learn notes that change requirements push people to predictable passwords.
2. Writing a policy Microsoft 365 cannot enforce. If your policy says "no complexity rules", note the Entra exception so auditors and staff are not confused.
3. Skipping the banned list. The global list does not know your company name or your office road.
4. Applying "never expire" tenant-wide on day one. Test first, and know that synced accounts behave differently.
5. Forgetting admins and service accounts. Use separate admin accounts with MFA, and give service accounts long random secrets in a vault.
6. Relying on passwords alone. Without MFA, even a 15-character password is exposed to phishing.

How to check it worked

1. Sign in as a test user, try to set a password containing your company name and confirm it is rejected.
2. Run the Get-MgUser command above and confirm the "never expires" column matches your decision.
3. Review Entra ID > Authentication methods > Password protection and confirm Enforce custom list shows Yes.
4. Try 10 different wrong passwords on a test account (the default threshold; repeats of one wrong password are not counted) and confirm lockout behaves as the policy says.
5. Export the users who have not registered MFA, using the command in our MFA guide, and chase the rest. A Microsoft 365 security audit gives an independent view of the whole tenant.

FAQ

What is a corporate password policy?

It is the written rules for how staff create, store, share and reset passwords, plus what happens when one is compromised. The template above is a starting point.

What is a good password example?

A long passphrase of several unrelated words that you have not used elsewhere is better than a short string full of symbols. We do not publish a sample, because anything printed in an article is a bad password.

How do I fix "password does not meet password policy requirements"?

In Entra ID the new password must be 8 to 256 characters, include three of four character types, not match the global or custom banned list, and differ from the last password when you change it. Try a longer passphrase with a number and symbol added.

What is the Microsoft 365 password policy?

For cloud-only accounts it is predefined. You can change only the expiry period and whether passwords expire. Microsoft recommends a 14-character minimum and no expiry.

What do NIST password guidelines recommend?

At least 15 characters for passwords used alone, at least 8 with MFA, support for 64 or more, no composition rules, no scheduled changes and blocklist screening.

For help writing and enforcing the policy across your tenant, see our cybersecurity services.

If you would rather know the price of a full review before you start, what a Microsoft 365 security audit costs sets out the fixed prices by headcount.