Windows machines should prohibit reuse of the previous 24 passwords
Requires that prerequisites are deployed to the policy assignment scope. Machines are non-compliant if Windows machines allow re-use of the passwords after the specified number of unique passwords. Default value for unique passwords is 24.
The Enforce password history setting determines the number of unique new passwords that must be associated with a user account before an old password can be reused.
What this control checks
Windows machines must prevent reuse of the previous 24 passwords
Common pitfalls
Policy assignment scope needs prerequisites deployed
Requires that prerequisites are deployed to the policy assignment scope.
Arc connected machines incur a monthly charge
By selecting this option, you agree to be charged monthly per Arc connected machine.
IncludeArcMachines defaults to false
IncludeArcMachines has a defaultValue of false.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit Windows machines that allow re-use of the passwords after the specified number of unique passwords" (5b054a0d-39e2-4d53-bea3-9734cad2c69b); PowerPipe control azure_compliance.control.compute_vm_restrict_previous_24_passwords_resuse_windows.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to IA-5(1) (Password-based Authentication).
FedRAMP Moderate Baseline Rev 4: Mapped to IA-5(1) (Password-Based Authentication).
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5(1) Password-Based Authentication
- 3.5.8: Prohibit password reuse for a specified number of generations.
- IA.L2-3.5.8 Prohibit password reuse for a specified number of generations
- Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
- Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_restrict_previous_24_passwords_resuse_windows - Powerpipe Control:
azure_compliance.control.compute_vm_restrict_previous_24_passwords_resuse_windows - Azure Policy Definition:
5b054a0d-39e2-4d53-bea3-9734cad2c69b
Last reviewed: 2026-10-11