CISA.MS.AAD.6.1: User passwords SHALL NOT expire.
| ID | CISA.MS.AAD.6.1 |
| Severity | Medium |
| Suite | CISA SCuBA baselines |
| Product | Entra ID |
| Related products | Microsoft 365 |
| Feature | Password protection |
| Security area | Authentication |
| Resource type | Domain |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.6.1 (SHALL) |
| Framework controls | cisa-scuba:MS.AAD.6.1nist-800-53-r5:IA-5(1) Authenticator Management | Password-based Authentication |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”User passwords SHALL NOT expire.
The National Institute of Standards and Technology (NIST), OMB, and Microsoft have published guidance indicating mandated periodic password changes make user accounts less secure. For example, OMB-22-09 states, “Password policies must not require use of special characters or regular rotation.”
Remediation action
Section titled “Remediation action”Configure password policies to set passwords to never expire.
- In Microsoft 365 admin center under Settings and Org settings, select the tab Security & privacy.
- Under Password expiration policy, set Set passwords to never expire.
- Click Save.
Related links
Section titled “Related links”- Microsoft 365 admin center - Org settings | Password expiration policy
- Configure the Password expiration policy
- CISA Passwords - MS.AAD.6.1v1
- CISA ScubaGear Rego Reference
Mito check, based on CISA ScubaGear. Author: soulemike; contributors: michaelmsonne, jed-exotic, brianreidc7. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.