What is the latest and greatest in password creation rules anyway? It is hard to define a password policy which covers both users' practical needs and still m

What is the latest and greatest in password creation rules anyway? It is hard to define a password policy which covers both users' practical needs and still makes ERP systems secure and follows best practice of the major players. Microsoft research has an interesting paper on it. Are there more like this out there? https://www.microsoft.com/en-us/research/wp-content/uploads/2016/06/Microsoft_Password_Guidance-1.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/... Hints welcome!