CISA.MS.AAD.6.1 - User passwords SHALL NOT expire.

Contributed by Michael Soule with 3 co-contributorsAll contributors →

Overview

User passwords SHALL NOT expire.

The National Institute of Standards and Technology (NIST), OMB, and Microsoft have published guidance indicating mandated periodic password changes make user accounts less secure. For example, OMB-22-09 states, "Password policies must not require use of special characters or regular rotation."

Remediation action

Configure password policies to set passwords to never expire.

1. In Microsoft 365 admin center under Settings and Org settings, select the tab Security & privacy.
2. Under Password expiration policy, set Set passwords to never expire.
3. Click Save.

Related links

• Microsoft 365 admin center - Org settings | Password expiration policy
• Configure the Password expiration policy
• CISA Passwords - MS.AAD.6.1v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.AAD.6.1
Severity	Medium
Suite	CISA
Product	Entra ID
Related products	Microsoft 365
Feature	Password protection
Area	Authentication
Resource type	Domain
User impact	Low
Implementation cost	Low
MITRE ATT&CK	None
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.6.1
Criticality	SHALL
Upstream requirement	MS.AAD.6.1v1
Supports controls	cisa-scuba:MS.AAD.6.1, nist-800-53-r5:IA-5(1)
PowerShell test	Test-MtCisaPasswordExpiration
Services	Graph

Source

• Test: tests/cisa/entra/Test.CISA.MS.AAD.6.1.ps1
• Documentation: tests/cisa/entra/Test.CISA.MS.AAD.6.1.md