This guide translates NIST-aligned password guidance into concrete configuration steps for identity platform administrators. It assumes familiarity with your identity provider's admin console (e.g., Microsoft Entra ID) and is intended to accompany, not replace, your organization's written password policy.

• Set minimum password length to at least 12 characters.
• Confirm maximum password length supports at least 64 characters.
• Disable mandatory calendar-based password expiration for cloud-only accounts, unless a specific compliance requirement mandates it.
• Remove mandatory character-composition requirements where the platform allows it.

• Enable your identity platform's built-in breached/common-password screening (e.g., Entra Password Protection).
• Build a custom banned-password list covering your organization name, product names, and predictable local terms.
• For hybrid identity environments, deploy the on-premises agent so screening applies to both cloud and on-prem password changes.

• Enforce MFA for all users via Conditional Access (or equivalent) rather than relying solely on platform defaults.
• Audit existing exclusions — legacy Conditional Access rules, break-glass accounts, and service accounts — and remove any that are no longer justified.
• Disable legacy authentication protocols that do not support MFA.
• Prioritize hardware-backed or phishing-resistant MFA for administrative and privileged accounts.

• Provision the organization's password manager through SSO so offboarding automatically revokes vault access.
• Run a structured, scheduled migration of existing credentials rather than waiting for organic adoption.
• Enforce a strong, unique master password and MFA on the vault account itself.
• Where supported, configure browser policy to discourage saving credentials outside the approved manager.

• Set account lockout threshold between 5 and 10 failed attempts, depending on your risk tolerance.
• Configure lockout duration and any auto-unlock behavior.
• Require identity verification beyond security questions for any self-service password reset flow.

Document every configuration choice above against your organization's written password policy, noting the rationale for any deviation from default framework guidance. Schedule a review of this configuration at least annually, or immediately following any relevant guidance update or security incident.

• Microsoft Password Best Practices — /knowledge-center/cybersecurity/password-security/microsoft-password-best-practices
• Building a Password Policy Template — /knowledge-center/cybersecurity/password-security/password-policy-template
• Password Policy Generator — /tools/password-policy-generator