Allow Long Passwords
the current max password is 16 chars, please make it larger
https://www.troyhunt.com/passwords-evolved-authentication-guidance-for-the-modern-era/
Longer is (Usually) Stronger section
source of current max length: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-policy
Mike DePouw
shared this idea
Hey folks,
We now support up to 256 character passwords, including spaces. Please see Alex’s blog post for some more details:
https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Removal-of-the-16-character-limit-for-passwords-in-Azure-AD/ba-p/565275
65 comments
-
Adam Lloyd
commented
Can you work on allowing customisation of AAD password complexity / policy?
Kinda pointless allowing for extra character length (8-256) if we cannot customise our complexity requirements that appear on the likes of SSPR splash screens and such :/ so that it falls in line with our on-prem policy. (i.e a greater minimum than 8 characters)
-
Kristian
commented
Seems changing password from Office365 (instead of admin panel) won’t let you use spaces and only 255 letters.
-
Rick Wilson
commented
Is this also updated in the Government Cloud (GCC)?
-
Mike Mason
commented
Thank you! Now we need to work on the complexity requirements, them being an option ;)
-
Scott Ivey
commented
https://account.activedirectory.windowsazure.com/ChangePassword.aspx
This page still has validators limiting the password textbox to 16 characters. Please fix this spot as well.
-
Anonymous
commented
Is this Azure AD change also on GCC High tenants? Or is this change only for commercial?
-
Josh Villagomez
commented
I don't like passwords. Interesting developments on FIDO2 certification of the latest Win10 build - https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Hello-FIDO2-certification-gets-you-closer-to/ba-p/534592
-
Katy
commented
Ironic thing is this feedback system lets you have stronger passwords than an Office 365 Tenancy Global Admin account can have! 2 years on from the original post and we're still stuck on 16 characters?
-
Olav Rønnestad Birkeland
commented
I've found a workarround that allows password up to 60 character, which is the longest I've tested so far. Just set password with the AzureAD module, and specify that user must change password at next login. At that next login you can set passwords longer than the default max of 16 characters.
Set-AzureADUserPassword with -ForceChangePasswordNextLogin.
This is peobably a bug/ design flaw, but it works for setting longer passwords. Perfect for service account and similar where you can't use MFA.
-
Mike Mason
commented
Echoing Viktor's request. Any progress yet? Microsoft is putting out these new password guidelines, and nobody can even begin to implement this with this crazy never-should-have-been-a-thing restriction. This should be a very high priority for MS before things like UI improvements.
-
Viktor Hedberg
commented
Any progress to report yet?
-
Magruder Administrator
commented
Per NIST guidelines, increase the password length. Up to 64 characters would be optimal.
SP 800-63 Digital Identity Guidelines
https://doi.org/10.6028/NIST.SP.800-63-3SP 800-63A Enrollment and Identity Proofing
https://doi.org/10.6028/NIST.SP.800-63aSP 800-63B Authentication and Lifecycle Management
https://doi.org/10.6028/NIST.SP.800-63bSP 800-63C Federation and Assertions
https://doi.org/10.6028/NIST.SP.800-63c -
Anonymous
commented
Here's another comment on the ridiculousness of the password complexity limitations in Azure AD.
-
Anonymous
commented
How is Microsoft planning on the move to Azure AD if it still requires an on-prem AD just to have proper password policies..... Not to mention I have no power over Local passwords with Azure AD, even with the use of Intune.
-
Tao
commented
Let us use our own passwords.. I have three, well had three passwords i used sense 1999.. Random letters and numbers i memorized.. Now i am not allowed to alternate my password and now have to save them in my phone.. Now its super insecure. I conplained to Microsoft directly to be told use finger print.. Oh thays even easier to get someones finger print, how about log into person account with a picture fron there account.. Why is everyone makimg it easier for people to hack into your account, just because you say its better, dont mean it is... Up until last two years had no issues, now i have issues all the time with my account.. Let me be in control of my account, let me have my own personal password i dont have to save in phone or write down.. I bet i could call anyone in Microsoft say my password and none of them would still not get it right.. My new password well is easy to fivure out and guessing i willl have to switch to another company because I lost my mac (iphones over password) lost my Google account and now i will be losijg my Microsoft account, guess i will be joining the Chinese internet or Russian apps because American companies have no clue how to keep our accounts safe, only makong it easier to hack by making us change passwords every 6 months and forcing us to save in new floders with all our account passwords.. Guess its easier for them to track us and get all our info including access to our accounts /sell access to other companies or whoever...
-
Anonymous
commented
I really hope you will also allow customers to getting rid of the mandatory requirement of using 3 out of the 4 character sets. That policy is so 90s and just leads to users creating stupid passwords like Password123 while it doesn't allow using secure ones like bluegoatdollechopox
-
Daniel
commented
We do not have on prem AD. Please correct this horrendous error in judgement on Microsoft's part and allow our users to better protect themselves. From: https://docs.microsoft.com/en-us/office365/enterprise/protect-your-global-administrator-accounts - "You own your data and identities and the responsibility for protecting them, the security of your on-premises resources, and the security of cloud components you control." No Microsoft, apparently I cannot control the security. Even Global Admins are restricted to 16 characters.
-
Rob Wilderman
commented
I am encouraging everyone to do as I plan on doing and complain about this issue weekly to 365 Support until it gets resolved. This text does not cause enough pain on this issue. We need to start being a really really squeaky wheel. If we all open a ticket weekly, then it is cutting into MS bottom line, and they will need to listen.
-
Rob Wilderman
commented
Some major operating systems are now suggesting strong passwords that go beyond the 16 character length. Apple's Safari password vault suggests 25 character passwords for example. It is confusing and disheartening to our users who are trying to put in to practice what we have been preaching about password security to them, to have an error pop up when they try to use a more secure password. Yes we can change the password on Premise, and then synchronize it at the next ADSyncCycle, but a user should not have to wait to start using their e-mail again for a pre-determined period of time after changing their password. This is unacceptable. I cannot imagine why this seemingly arbitrary limit was put in place to start with in the Cloud. Microsoft's cloud products should have remained compatible with On-Premise products at all times.
-
Daniel Rollins
commented
I'm with everyone else on this, how in the world do we have a 16 char max and no spaces? Regular AD has allowed both for years because it is more secure. Did they just copy the Azure password system from some really old code? Get with the program MSFT, how long can it possibly take to increase the max to something reasonable, like maybe 64, and allow spaces? I still can't believe this actually went public in its current state.