Password Policy Enforcer

The password policy settings enhance security by defining rules for creating strong passwords. You can establish standards to prevent users from using common passwords and ensure the passwords they create adhere to the security and compliance requirements of your organization. From a security standpoint, this approach offers several advantages:

1. Enhanced protection: Implementing password policies strengthens the overall security of your systems and data. It ensures that passwords are not easily guessable, adding an additional layer of security against unauthorized access.
2. Complexity: Password policies often mandate complexity, requiring the use of a combination of uppercase and lowercase letters, numbers, and special characters. This complexity makes it harder for attackers to crack passwords through brute force or dictionary attacks.
3. Preventing common passwords: Policies can include checks to ensure that commonly used and easily guessable passwords, such as, "password" or "123456" are not allowed. This helps safeguard against predictable choices.
4. Compliance: Many regulatory requirements and security standards mandate the implementation of strong password policies. Adhering to these policies ensures compliance.

How the password policy will be applied

• For users registered in Identity360's Universal Directory, the password policy configured in Identity360 will be enforced.
• For users sourced from other directories, the password policy configured in that directory will be applied.
• Identity360 enables administrators to enforce robust password policies, ensuring that even if Azure AD has weaker password requirements, when an admin resets a user's password, it will align with Identity360's strong password policy, validating that the organization's security standards remain consistent.

To configure the password policy

1. Navigate to the Settings tab > Management Settings > Password Policy Enforcer.
2. In this section you can manage:
• Characters: Limit the use of special characters, numbers, uppercase and lowercase letters, and unicode characters in passwords. You can also specify the initial character requirement and prohibit the use of numerals as the last character.

• Repetition: Restrict the use of consecutive characters from the username or the repetitive use of characters.

• Length: Specify the minimum and maximum password length.

• Patterns: You can choose to restrict certain patterns such as keyboard sequences, and disallow the use of palindromes.

3. You also have the option to allow users to bypass password complexity requirements when the password length exceeds a predefined limit, for example, 20 characters.
4. You can require passwords to meet a minimum number of complexity rules from the options provided above and opt to enforce specific rules as mandatory.

Previous Topic Next Topic