Why Microsoft Recommends Passwords That Don't Expire

Why did the guidance change?

When businesses require everyone to change passwords every 30, 60, or 90 days, employees often make small, predictable changes to a familiar password. Others may write down the latest version or reuse one from another account.

Consider a seasonal password pattern such as Summer2026! followed by Fall2026!. The password has changed, but the pattern is easy to guess. A calendar-based reset alone does not address that risk.

Microsoft's password policy recommendations discourage mandatory periodic expiration for cloud-only users. The goal is to improve real account protection, rather than simply increase the frequency of changes.

Five better ways to protect business accounts

1. Use long, unique passwords. Each work account should have its own password. Never reuse a work password on personal sites or other services.
2. Enable multifactor authentication (MFA). MFA adds an important protection if a password is stolen. Where available, use phishing-resistant methods such as passkeys or security keys.
3. Use a reputable password manager. It helps employees generate and store strong, distinct passwords without relying on memory or spreadsheets.
4. Monitor account activity and exposed credentials. Investigate unusual sign-ins, suspicious inbox rules, reported phishing, and breached-password alerts.
5. Reset passwords when there is evidence of compromise. A password exposed in a breach, shared accidentally, or used during unauthorized access needs prompt attention, even if it is only a day old.

When should you change a password?

Reset a password when it is known or reasonably suspected to have been compromised, when an unauthorized party may know it, or when your organization's incident-response process requires it. Review active sessions and related account activity too; changing a password may be only one part of containing an incident.

Staff can still change a password voluntarily. The recommendation is to remove unnecessary scheduled resets, not to prohibit password changes.

Important exception: hybrid Active Directory and compliance

Microsoft's cloud-only recommendation does not automatically apply to every business account. Organizations that synchronize identities with on-premises Active Directory, use federation or pass-through authentication, or have specific contractual or regulatory requirements may need a different configuration.

Before changing a company-wide policy, have your IT team confirm where passwords are managed, which controls are enforced, and whether applicable requirements mandate a different approach. See Microsoft's configuration guidance for the distinction between cloud-only and hybrid accounts.