Back to Checks
m365

Tenant password policy is set to never expire

admincenter_settings_password_never_expire
Service: admincenterSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft 365 tenant password policy is configured so user passwords do not expire (never expire), meaning no time-based rotation is enforced across accounts.

Prowler logoProwlerprowler-provider-m365

Risk

Forced password expiration degrades security: users adopt predictable patterns and reuse credentials, reducing confidentiality and integrity. It boosts success of password spraying and credential stuffing, encourages insecure storage and helpdesk resets, and can disrupt service accounts, impacting availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks admincenter_settings_password_never_expire

Recommendation

Set passwords to never expire and enforce layered controls: MFA with risk-based challenges, banned-password checks, and strong length. Apply least privilege and monitor sign-ins. Rotate credentials only after compromise or risk, and favor managed non-human identities for automation instead of time-based password cycling.

Remediation

CLI

Set-MsolPasswordPolicy -DomainName <DOMAIN_NAME> -ValidityPeriod 2147483647

Other

1Sign in to the Microsoft 365 admin center: https://admin.microsoft.com
2Go to Settings > Org settings > Security & privacy
3Open Password expiration policy and check Set passwords to never expire
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.admincenter.admincenter_client import (
    admincenter_client,
)


class admincenter_settings_password_never_expire(Check):
    """Check if the tenant enforces a 'Password never expires' policy.

    This check verifies whether the tenant-wide password policy (surfaced through the first
    domain returned by Microsoft 365) is set to never expire. If the password validity period
    is set to `2147483647`, the policy is considered to have 'password never expires'.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for password never expires policy.

        This method inspects the tenant-level password validity configuration (exposed through
        the first available domain) and checks if the password validity period is set to
        `2147483647`, indicating that passwords for users in the domain never expire.

        Returns:
            List[CheckReportM365]: A list of reports indicating whether the domain's password
            policy is set to never expire.
        """
        findings = []
        password_policy = getattr(admincenter_client, "password_policy", None)
        if password_policy:
            report = CheckReportM365(
                self.metadata(),
                resource=password_policy,
                resource_name="Password Policy",
                resource_id="passwordPolicy",
            )
            report.status = "FAIL"
            report.status_extended = (
                "Tenant Password policy does not have a Password never expires policy."
            )

            if password_policy.password_validity_period == 2147483647:
                report.status = "PASS"
                report.status_extended = (
                    "Tenant Password policy is set to never expire."
                )

            findings.append(report)

        return findings

References