How to set Microsoft Entra ID password to never expire

Microsoft Entra ID's (formerly Azure Active Directory) password expiration policy determines how long a user’s password remains valid before it must be changed. In many environments, frequent password resets can lead to operational disruptions, broken integrations, and increased help desk requests, especially for service accounts, automation workflows, and critical access accounts.

Due to this, organizations often choose to set an Entra ID password to never expire for specific accounts. This helps maintain continuity by eliminating forced password changes that could interrupt business processes.

This approach is also supported by guidance from the NIST SP 800-63B, which no longer recommends periodic password changes unless there is evidence of compromise.

To implement this, administrators can use the DisablePasswordExpiration policy value, which allows an Entra ID user password to never expire and remain valid indefinitely.

When should you disable password expiration?

Setting Entra ID passwords to never expire can be appropriate in scenarios such as:

• Service accounts running automated processes
• Break-glass or emergency access accounts
• Automation workflows where password rotation can cause failures
• Shared operational accounts used in controlled environments

However, removing password expiration shouldn’t mean relaxing security. At a minimum, it should be paired with MFA to reduce risk.

Does setting Entra ID passwords to never expire apply to hybrid users?

The methods discussed in this document apply only to cloud-only user accounts in Entra ID. If your environment uses password hash synchronization on-premises, then:

• Password policies are controlled by on-premises AD.
• Entra ID password expiration settings do not apply.

This distinction is critical to avoid misconfiguration in hybrid identity environments.

Set an individual Entra ID user password to never expire using PowerShell

Prerequisites

• Your account must have one of the required administrative roles in Microsoft Entra ID, such as:
  • Global Administrator
  • Password Administrator access
• You have configured the Microsoft PowerShell environment in your system.

The recommended modern approach uses the Microsoft Graph PowerShell module.

Steps to set password to never expire using PowerShell

1. Open PowerShell with administrative privileges.
2. Connect to Azure Active Directory using the following command:
   Copy Connect-MgGraph
3. Set the user’s password to never expire by running:
   Copy Update-MgUser -UserId <user ID> -PasswordPolicies DisablePasswordExpiration

Replace <user ID>with the user’s User Principal Name (UPN) or Object ID.

This command updates the user’s password expiration policy so their password will no longer expire.

Set Entra ID passwords to never expire for all users via GUI

Prerequisites:

• You must have access to the Microsoft 365 Admin Center.
• Your account must have one of the required administrative roles in Microsoft Entra ID, such as:
  • Global Administrator
  • User Administrator

Steps to enable Entra ID password never expires

1. Go to the Microsoft 365 Admin Center.
2. Navigate to Settings > Org Settings.
3. Open Security & privacy.
4. Select Password expiration policy.
5. Check Set passwords to never expire.
6. Save changes.

Fig 1. Microsoft 365 Admin Center password expiration policy settings

This applies a tenant-wide password expiration policy for all cloud-only users.

Verifying password never expires settings

To confirm the configuration, you can query user settings using PowerShell:

If DisablePasswordExpiration is present, the setting has been applied successfully.

For tenant-wide audits, admins can run queries to identify all users with non-expiring passwords and review them periodically.

Password security practices when setting Entra ID passwords to never expire

While disabling expiration can improve usability, it must be implemented carefully. The following practices are recommended:

• Use strong passphrases instead of frequent resets: Encourage passwords that are at least eight characters, as per NIST SP 800-63B recommendation, and at most 64 characters long, preferably passphrases that are harder to crack yet easier to remember.
• Enforce advanced password policies: Define strong password requirements such as minimum length, passphrase usage, dictionary restrictions, and banned password lists to prevent weak or commonly used credentials.
• Enable MFA: Configure MFA so that even if a password is compromised, unauthorized access is blocked.
• Audit and monitor regularly: Periodically review accounts configured with the DisablePasswordExpiration policy value to ensure they are still required and secure.
• Educate users and maintain fallback controls: Combine strong password policies with user awareness and self-service tools to reduce reliance on weak password habits.

Managing password security with ADSelfService Plus

ADSelfService Plus helps organizations enforce strong password policies even when expiration is disabled.

With ADSelfService Plus, you can:

This ensures strong security without compromising user experience, even when passwords are set to never expire.