Windows machines should have maximum password age set to 70 days
Checks the maximum password age setting on Windows virtual machines using Azure Policy guest configuration. The Azure Policy default value for maximum password age is 70 days. Requires that prerequisites are deployed to the policy assignment scope.
The Maximum password age setting determines the period of time (in days) that a password can be used before the system requires the user to change it.
What this control checks
Windows machines pass or fail based on their configured maximum password age policy
Common pitfalls
Policy assignment scope needs prerequisites deployed first
Requires that prerequisites are deployed to the policy assignment scope.
Arc machines are excluded unless the parameter is changed
The IncludeArcMachines parameter has a defaultValue of false.
Including Arc machines is billed monthly per machine
By selecting this option, you agree to be charged monthly per Arc connected machine.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit Windows machines that do not have the maximum password age set to specified number of days" (4ceb8dc2-559c-478b-a15b-733fbf1e3738); PowerPipe control azure_compliance.control.compute_vm_max_password_age_70_days_windows.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to IA-5(1) (Password-based Authentication).
FedRAMP Moderate Baseline Rev 4: Mapped to IA-5(1) (Password-Based Authentication).
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5(1) Password-Based Authentication
- Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
- Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters
Related controls
- Windows machines should not store passwords using reversible encryption
- Linux virtual machines should have the Linux Guest Configuration extension installed for assignments
- Windows Azure Arc machines should have the Log Analytics extension installed
- Windows virtual machines should have the network traffic data collection agent installed
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_max_password_age_70_days_windows - Powerpipe Control:
azure_compliance.control.compute_vm_max_password_age_70_days_windows - Azure Policy Definition:
4ceb8dc2-559c-478b-a15b-733fbf1e3738
Last reviewed: 2026-10-11