Windows machines should have the password complexity setting enabled
Requires that prerequisites are deployed to the policy assignment scope. Machines are non-compliant if Windows machines do not have the password complexity setting enabled. The Azure Policy check audits these machines.
What this control checks
Windows machines without the password complexity setting enabled are non-compliant.
Common pitfalls
Prerequisites must be deployed to the scope
Requires that prerequisites are deployed to the policy assignment scope.
Arc connected servers are not included by default
By selecting this option, you agree to be charged monthly per Arc connected machine. The IncludeArcMachines parameter has defaultValue of false.
Effect can be set to Disabled
The effect parameter allows AuditIfNotExists and Disabled. Its defaultValue is AuditIfNotExists.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit Windows machines that do not have the password complexity setting enabled" (bf16e0bb-31e1-4646-8202-60a235cc7e74); PowerPipe control azure_compliance.control.compute_vm_password_complexity_setting_enabled_windows.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to IA-5(1) (Password-based Authentication).
FedRAMP Moderate Baseline Rev 4: Mapped to IA-5(1) (Password-Based Authentication).
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5(1) Password-Based Authentication
- 3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- IA.L2-3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- IA-5(1) Password-Based Authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_password_complexity_setting_enabled_windows - Powerpipe Control:
azure_compliance.control.compute_vm_password_complexity_setting_enabled_windows - Azure Policy Definition:
bf16e0bb-31e1-4646-8202-60a235cc7e74
Last reviewed: 2026-10-11