Configure password rules
Configure password rules for length, character types, history, and expiration to strengthen account security and enforce policy compliance.
Password rules control how users create and maintain their passwords. They span three sections of the policy form: Password Policy, Password history, and Password life. Tick a rule's checkbox to reveal and set its values.
Password requirements
In the Password Policy section, enable the rules you want to enforce:
- Set min/max length: minimum and maximum character count
- Set min/max lowercase characters
- Set min/max uppercase characters
- Set min/max numerical characters
- Set min/max alphabetic characters
- Set min/max special characters
- Enforce maximum number of equal consecutive characters: limit how many times the same character can repeat in a row (e.g. no "aaa")
- Forbid password equal to username
- Forbid password containing username
- Forbid whitespaces in password
Each character rule sets both a minimum and a maximum, so you can require at least a number of a character type and optionally cap it.
Password history
In the Password history section:
- Remember previous passwords: track past passwords so they can't be reused. Set Number of previous passwords to remember.
- Enforce uniqueness against previous passwords: reject a new password that matches any remembered one.
- Consider too old passwords as available for reuse: allow reuse of passwords older than the remembered window.
Password life
In the Password life section:
- Enforce password change after reset: require a password change at the next login after an admin reset.
- Enforce password change after first login: require a password change on a user's first login.
- Limit password lifetime: require users to change their password after a set period. Enabling it reveals the expiration settings.
Last updated on