How to check the password expiration policy in Microsoft 365

Before you start

Use an account in the Global Reader role, which can read everything a Global Administrator can and change nothing; changing the policy needs User Administrator. The PowerShell example requests Domain.Read.All, and the account check User.Read.All; your organisation may require administrator consent.

Know where the setting lives. Entra ID keeps the policy on each managed domain, and the admin centre sets it for all of them. A domain added later, or converted from federated to managed, keeps the default until the policy is set again. Microsoft no longer sends notices before a password expires. The examples read and export; they change nothing.

Option 1

Check the password expiration policy with PowerShell

Install the modules once, then connect and export each domain's password settings, the default domain first.

# Install once, if the modules are not already installed.
$modules = 'Microsoft.Graph.Authentication', 'Microsoft.Graph.Identity.DirectoryManagement',
    'Microsoft.Graph.Users'
Install-Module $modules -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'Domain.Read.All' -NoWelcome
try {
    # Microsoft's value for passwords that never expire.
    $never = [int]::MaxValue
    $report = @(Get-MgDomain | Sort-Object { -not $_.IsDefault }, Id | ForEach-Object {
        $days = $_.PasswordValidityPeriodInDays
        [pscustomobject]@{
            Domain             = $_.Id
            Default            = $_.IsDefault
            Verified           = $_.IsVerified
            Authentication     = $_.AuthenticationType
            PasswordExpiryDays = if ($days -eq $never) { 'Never' } else { $days }
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'No domains were returned.'
    } else {
        $report | Export-Csv -Path './password-expiration.csv' -NoTypeInformation -Encoding utf8
        $expiring = @($report | Where-Object { $_.PasswordExpiryDays -ne 'Never' }).Count
        Write-Output "$expiring of $($report.Count) domains have passwords that expire."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

PasswordExpiryDays shows Never for 2147483647. Authentication is Managed or Federated; the policy doesn't apply to a federated domain's users, who sign in through the federation service. Compare the rows: a domain with a different value from the others was probably added after the policy was set.

List accounts whose passwords never expire

An account can be set never to expire whatever the domain says. Reconnect with Connect-MgGraph -Scopes 'User.Read.All', then list them.

# Run while connected to Microsoft Graph with User.Read.All.
$properties = 'userPrincipalName', 'passwordPolicies', 'onPremisesSyncEnabled'
Get-MgUser -All -Property $properties |
    Where-Object { $_.PasswordPolicies -like '*DisablePasswordExpiration*' } |
    Select-Object UserPrincipalName, PasswordPolicies, OnPremisesSyncEnabled

Synced accounts often appear here, because Microsoft Entra Connect sets DisablePasswordExpiration on them by default.

Option 2

Check the policy in the admin centre

1. Sign in to the Microsoft 365 admin centre for the correct tenant.
2. Select Show all, then Settings > Org settings.
3. On the Security and Privacy tab, select Password expiration policy.
4. Read Set passwords to never expire (recommended). When it is cleared, Days before passwords expire shows the period.
5. Close the pane without saving.

This suits a quick look at the organisation's setting. It shows 1 setting, not each domain or the accounts set never to expire, so for those, use PowerShell or a report.

Common questions

What does 2147483647 days mean?

That the domain's passwords never expire. It's the value Microsoft Graph and PowerShell show for the never expire setting.

Why don't synced users' passwords expire in the cloud?

With password hash sync, Microsoft Entra Connect marks each synced account so the cloud expiry policy is ignored, and the on-premises policy applies. To make Entra ID apply its own expiry to them, turn on the CloudPasswordPolicyForPasswordSyncedUsersEnabled feature.

Should passwords expire at all?

Microsoft marks never expire as recommended, and suggests MFA as the defence against weak or reused passwords. To find the accounts without it, see how to find users without MFA.