Password policy in Azure AD (Office 365)

Applies To: Azure, Office 365, Windows Intune

This topic describes the various password policies and complexity requirements associated with the user accounts stored in your Azure AD tenant.

UserPrincipalName policies that apply to all user accounts

Every user account that needs to sign in to the Azure AD authentication system must have a unique user principal name (UPN) attribute value associated with that account. The following table outlines the polices that apply to both on-premises Active Directory-sourced user accounts (synced to the cloud) and to cloud-only user accounts.

Property	UserPrincipalName requirements
Characters allowed	A – Z a – z 0 – 9 . - _ ! # ^ ~
Characters disallowed	@ Cannot contain a dot character '.' immediately preceding the '@' symbol
Length constraints	Total length must not exceed 113 characters Total length must not exceed 113 characters 64 characters before the ‘@’ symbol 48 characters after the ‘@’ symbol

Password policies that apply only to cloud user accounts

The following table describes the available password policy settings that can be applied to user accounts that are created and managed in Azure AD.

Property	Standard strength passwords	Strong passwords
Characters allowed	A – Z a – z 0 – 9 @ # $ % ^ & * - _  + = [ ] { } \| \ : ‘ , . ? / ` ~ “ ( ) ;
Characters disallowed	Unicode characters spaces	Unicode characters spaces Cannot contain a dot character '.' immediately preceding the '@' symbol
Password restrictions	8 characters minimum and 16 characters maximum	8 characters minimum and 16 characters maximum Requires 3 out of 4 of the following: Lowercase characters Uppercase characters Numbers (0-9) Symbols (see password restrictions above)
Password expiry duration	Default value: 90 days Value is configurable using the Set-MsolPasswordPolicy cmdlet from the Azure Active Directory Module for Windows PowerShell.
Password expiry notification	Default value: 14 days (before password expires) Value is configurable using the Set-MsolPasswordPolicy cmdlet.
Password Expiry	Default value: false days (indicates that password expiry is enabled) Value can be configured for individual user accounts using the Set-MsolUser cmdlet. See Set a password to never expire for instructions.
Password history	Last password cannot be used again.
Password history duration	Forever
Account Lockout	After 10 unsuccessful logon attempts (wrong password), the user will need to solve a CAPTCHA dialog as part of logon. After a further 10 unsuccessful logon attempts (wrong password) and correct solving of the CAPTCHA dialog, the user will be locked out for a time period. Further incorrect passwords will result in an exponential increase in the lockout time period.