Should passwords in Microsoft 365 expire regularly?

No. Microsoft advises against periodic expiration and sets passwords to never expire by default. Forced changes lead to predictable passwords.

Where do I set the expiration policy?

In the Microsoft 365 admin center under Settings > Org settings > Security & privacy > Password expiration policy.

Isn’t a password that never expires insecure?

Not if you use MFA for everyone, block weak passwords and have a password changed immediately as soon as there are signs it has leaked.

Can I stop staff from using our company name as a password?

Yes. With Microsoft Entra ID P1, included in Microsoft 365 Business Premium, you set up your own list of banned password terms, such as your company name and location.

Change passwords every 90 days? Why an SME is better off not doing that in Microsoft 365

Q: When should a password be changed immediately?

When it was entered on a phishing page, appears in a data breach, was shared with someone else or when Microsoft reports a risky sign-in.

A new password every three months is still standard practice in many SMEs. It feels secure, but in practice it leads to Summer2026!, Autumn2026! and a note under the keyboard. That is why Microsoft and other security authorities have moved away from it. In Microsoft 365, passwords no longer expire by default. Here is what to set up instead.

Why expiring passwords don’t help

The idea behind a password that expires every 60 or 90 days is that a stolen password becomes worthless after a while. But an attacker who steals a password usually uses it within hours or days, not months. Meanwhile, staff do exactly what you would expect: they pick an easy-to-remember base word and add one each time. Anyone who knows Company2026! guesses Company2027! in no time. That is why Microsoft and the US standards institute NIST advise against mandatory periodic changes and recommend changing a password only when there is a reason to.

How to check the expiration policy

Sign in to the Microsoft 365 admin center with an account that has the User Administrator role or higher.
Go to Settings > Org settings and open the Security & privacy tab.
Select Password expiration policy.
Make sure Set passwords to never expire (recommended) is checked and select Save.

By default, passwords in Microsoft 365 do not expire. If a period has been set in your organisation, someone chose it deliberately at some point, often a previous IT partner. A configured period is between 14 and 730 days. Note that Microsoft 365 no longer warns users in advance that their password is about to expire, and people who only use Outlook sometimes notice only days later. That causes unnecessary helpdesk calls.

This policy applies to cloud-only accounts. If you still synchronise users from your own Active Directory server, the password policy on that server determines what happens.

What to set up instead

MFA for everyone. With multifactor authentication, a password alone is useless to an attacker. This is by far the most important measure.
Block weak passwords. Microsoft Entra Password Protection automatically checks every new password against a global list of common and weak passwords, including variants such as P@ssw0rd. With Entra ID P1, included in Microsoft 365 Business Premium, you can add your own list of up to 1,000 terms, such as your company name, product names and location.
Long passphrases and a password manager. A long phrase is stronger and easier to remember than a short password full of symbols. For all other accounts, use a password manager or passkeys so nobody reuses passwords.
Self-service password reset. With self-service password reset, staff can securely reset a forgotten password themselves, without waiting for an admin.

When should a password be changed immediately?

Expiring on a calendar is not necessary, but changing for a reason is. Have a password replaced immediately if a member of staff entered it on a phishing page, if it appears in a known data breach, if Microsoft reports a risky sign-in or if someone shared the password. If you suspect an account has already been misused, follow the first steps for a compromised account: changing the password alone is not enough then.

How Floor ICT handles this

Floor ICT checks your password policy and sets it to the recommended setting. We make sure MFA is on for every account, fill the banned password list with your own company terms on Business Premium and set up self-service password reset. If Microsoft reports a risky sign-in or a password leaks, we make sure it is replaced straight away. Your environment becomes more secure and your staff have less hassle.

View MSP packages Request an intake Microsoft 365