Microsoft 365 passwords should be set to never expire

Forced periodic changes tend to push people toward small, predictable variations of the old password, which does not make accounts safer. Microsoft's own guidance recommends not expiring passwords on a schedule when MFA is in place and weak or leaked passwords are detected: password policy recommendations.

The reasoning is about behaviour rather than cryptography. A password that must change every few months is more likely to be written down or incremented by one digit, while a long unique password that stays put is easier for people to remember and does not give attackers a predictable pattern to guess.

In the Microsoft 365 admin center go to Settings, Org settings, Security & privacy, Password expiration policy. The box Set passwords to never expire should be ticked. Read-only with Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "Domain.Read.All"
Get-MgDomain | Select-Object Id, PasswordValidityPeriodInDays

A value of 2147483647 means passwords never expire.

In the admin center tick Set passwords to never expire and save. Or with PowerShell, for each domain:

Connect-MgGraph -Scopes "Domain.ReadWrite.All"
Update-MgDomain -DomainId <your-domain> -PasswordValidityPeriodInDays 2147483647

Before you do, confirm that MFA is required for all users. ConfigCobra only reads your environment and never changes it; the steps below are for you or your administrator to run.

Users stop receiving expiry prompts and no longer get locked out of services that cached an old password after a forced change. Help desk volume for expired passwords usually drops. Accounts synchronised from on-premises Active Directory still follow the on-premises policy, so that policy needs the same review. Make sure leaked-password detection and MFA are in place, since expiry no longer limits how long a stolen password works.

Communicate the change to your help desk and to users, since people may expect the old rotation reminders. Pair it with conditions that make a stolen password less useful: MFA for everyone, a banned password list, and a process to force a reset when an account is suspected to be compromised. The remediation impact view in ConfigCobra lists the affected users and policies before you apply a fix.