Why scheduled changes don't work
When people have to change passwords often, they pick predictable variations: Summer2025! becomes Fall2025!. Passwords get weaker, and people write them down or reuse them. That's why both international security agencies and Microsoft no longer recommend scheduled, forced password changes.
What's recommended instead
Passwords should be changed when there's reason to suspect they've been leaked – not on a calendar schedule. Long passphrases are better than short, complicated passwords. Most important, the password shouldn't be the only thing protecting the account.
The way forward is passwordless
With passkeys, Windows Hello, and other phishing-resistant methods, users often don't need to type a password at all. That's both more secure and easier.
What we recommend
- Remove requirements for scheduled password changes
- Block common and leaked passwords
- Require multi-factor authentication (MFA) for all accounts
- Adopt passkeys or Windows Hello
How we can help
Wondering what this means for your organization? Let's talk.
Request a meeting →