"Password guidelines for administrators" from Microsoft: https://learn.microsoft.com/en-us/microsoft-365/admin/misc/password-policy-recommendations?view=o365-w

"Password guidelines for administrators" from Microsoft: https://learn.microsoft.com/en-us/microsoft-365/admin/misc/password-policy-recommendations?view=o365-worldwide#password-guidelines-for-administrators https://learn.microsoft.com/en-us/microsoft-365/admin/misc/p... Third on the list: "Don't require mandatory periodic password resets for user accounts" Just a bit below that, they specifically call out why instituting password expiration is a bad idea: https://learn.microsoft.com/en-us/microsoft-365/admin/misc/password-policy-recommendations?view=o365-worldwide#password-expiration-requirements-for-users https://learn.microsoft.com/en-us/microsoft-365/admin/misc/p...