1. We have SSO, therefore everyone should be able to memorize their password. 2. Oops, we actually have 20+ passwords for everybody, and require several of th

1. We have SSO, therefore everyone should be able to memorize their password. 2. Oops, we actually have 20+ passwords for everybody, and require several of them to be changed every month or two. 3. Many passwords aren't used every day. 4. Writing passwords down is forbidden. 5. The usual stupid restrictions are in place on what kind of password can be used. 6. Resetting passwords is a cumbersome process that requires human intervention via a ticketing system and not just clicking on "forgot password". 7. A subset of passwords are set up by the help desk, do not expire, and do not have an obvious way to change them, so it seems certain 99% of users don't. But this all is typical of a large organization that's making an effort, and something such as, say, a small nonprofit with no in-house IT, is much worse in my experience.