Account & Password
Understanding Password Policy Requirements
This guide explains your organisation's Microsoft 365 password requirements so you can create a strong, compliant password without repeated rejections.
Time needed
5 minutes to read
Platform
Microsoft 365
Guide steps
3 clear sections
Before you begin
None — this is a reference guide.
Follow along
Step-by-step guide
Understand the typical complexity rules
- Instruction 1: Microsoft 365 passwords must usually be at least 8 characters long (many organisations require 12 or more).
- Instruction 2: Your password must include at least three of the following four types of characters: uppercase letters (A–Z), lowercase letters (a–z), numbers (0–9), and special characters (e.g. ! @ # $ % ^ & *).
- Instruction 3: Common words, your name, your organisation name, and the word 'password' are blocked.
- Instruction 4: Your new password cannot be the same as any of your last several passwords (typically the last five to ten).
Action map
Understand the typical complexity rules
- 01
Microsoft 365 passwords must usually be at least 8 characters long (many organisations…
- 02
Your password must include at least three of the following four types of characters:…
- 03
Common words, your name, your organisation name, and the word 'password' are blocked.
Visual guide
Use this visual action map alongside the written instructions above.
Open Microsoft account security help for Understanding Password Policy RequirementsUnderstand your organisation's expiry and other rules
- Instruction 1: Some organisations set passwords to expire every 90 days; others use Microsoft's recommended setting of no expiry combined with MFA. You will receive an email warning before expiry if your organisation uses expiry.
- Instruction 2: If you are prompted to change your password, do so promptly — delayed changes can result in sign-in failures across multiple apps and devices.
- Instruction 3: Contact the helpdesk if you are unsure what the specific expiry period is for your account.
Tips for choosing a strong, memorable password
- Instruction 1: Use a passphrase — a sequence of four or more unrelated words — e.g. 'Velvet-Cloud-Biscuit-47'. This is long, complex, and easy to remember.
- Instruction 2: Avoid reusing the same password across different services. If one service is breached, attackers will try the same password on your work account.
- Instruction 3: Use a password manager (such as Bitwarden or the one built into your browser) to generate and store strong, unique passwords so you do not need to remember them all.
- Instruction 4: Never share your password with colleagues or write it on a sticky note near your monitor.
Quick fixes
Troubleshooting
My new password is rejected but I think it meets all the rules
It may match a recently used password, or it may contain a word on Microsoft's banned-password list. Try a completely different passphrase approach. If the rejection message gives a specific reason, address that first. If you are still stuck, contact the helpdesk.
I am being asked to change my password every time I sign in
Your account may be flagged as requiring an immediate password change for security reasons, or a previous change did not fully complete. Contact the helpdesk — they can check the account status and resolve the loop.
Still need a hand?
Our support team can help with Microsoft 365.
Tell us where you got stuck and what you see on screen.