Tips for password policies
Prefer length and blocklists over complex composition rules.
Require unique passwords and encourage a password manager.
Mandate MFA for privileged and remote access.
Document exception handling and reset procedures.
Align policy with what your IdP can actually enforce.
A password policy you can actually issue
The template is language for length, reuse, MFA, and manager use — aligned with current guidance rather than mandatory monthly rotation theatre.
Adapt it to your IdP’s real knobs. A PDF that contradicts the login form trains people to bypass policy.
Adopt the password policy
Read the draft clauses
Drop rules your systems cannot enforce. Unenforceable policy is fiction.
Match IdP settings
Minimum length, banned lists, and MFA should match what the login page does.
Publish and train
Tell people to use a manager. Punishing long passphrases is the opposite of the goal.
Password policy FAQ
Should we force a change every 30 days?
Current guidance prefers long unique secrets and change-on-suspicion, not ritual rotation that causes reuse.
Is this a legal document?
It is a starting template. Have whoever owns policy in your org review it.
Does filling it send data to you?
No. Edits stay local until you copy them.