Password policy for businesses: current rules and the right password manager

The short answer: yesterday’s rules (eight characters, one capital letter, one symbol, a change every three months) produced predictable passwords. Current recommendations from NIST and Microsoft go the other way: long passwords rather than complicated ones, no forced change on a fixed schedule but an immediate change when in doubt, blocking common or breached passwords, multi-factor authentication on all access, and a business password manager so that every account has a unique password without anyone having to remember it. This guide gives a policy ready to adapt, the matching Microsoft 365 settings and the criteria for choosing a password manager.

At ALLSAFE SOLUTIONS, a managed IT provider in Casablanca, we roll out these rules as part of our business cybersecurity in Morocco offer. The rules quoted come from NIST SP 800-63B (revision 4) and Microsoft Learn documentation.

Why the old rules no longer work

The account takeovers we see in SMBs rarely start with a password “guessed” by hand. They come from a password reused on a site that leaked, a password typed into a fake sign-in page, or a password spray attack that tries a few very common passwords against every account in a company.

Against this, complexity rules and forced renewals have a perverse effect that Microsoft describes clearly: almost every constraint imposed on users makes passwords more uniform. You get “Company2026!”, then “Company2027!” at the next renewal. Attackers know this and start with those variants.

What NIST and Microsoft say

Rule	NIST SP 800-63B (revision 4)	Microsoft (Microsoft 365, Entra ID)
Minimum length	15 characters for a password used on its own; 8 if part of multi-factor authentication	14 characters recommended; Microsoft 365 requires at least 8
Maximum length	Accept at least 64 characters	Accept long passphrases
Composition rules	Must not require a mix of character types	Composition rules degrade password quality
Periodic change	Must not be required; mandatory change on compromise	Recommends that cloud account passwords never expire
Banned password list	Required: common, breached, service- or user-related passwords	Global list applied automatically by Entra ID, custom list available
Password managers and paste	Must be allowed	Do not reuse the work password anywhere else
Hints and security questions	Forbidden	Self-service reset paired with an authenticator app
Multi-factor authentication	Passwords are not phishing-resistant	Mandatory MFA registration, risk-based MFA

A password policy ready to adapt

Here is the policy we offer our SMB clients. It fits on one page, which matters: a policy nobody reads protects nothing.

1. Length: at least 14 characters for business accounts, at least 15 for any account without multi-factor authentication. Passphrases are encouraged.
2. Uniqueness: a work password is never used anywhere else, neither on another company account nor on a personal site.
3. No fixed-schedule change: the password is changed immediately on suspicion, a reported leak, a click on a phishing link or the departure of someone who knew it.
4. Banned words: the company name, its products, the city, first names, years and common passwords are rejected by the system.
5. Multi-factor authentication required on email, remote access, admin tools and business applications that offer it.
6. Password manager provided by the company for all accounts that do not go through single sign-on.
7. No password in plain text in a file, an email, instant messaging, a sticky note or the browser of a shared computer.
8. Separate admin accounts from everyday accounts, with secrets kept in a vault reserved for the IT team.
9. Departures: accounts disabled on the day of departure and every shared secret the person knew changed.

Settings in Microsoft 365 and Active Directory

• Expiration: in the Microsoft 365 admin centre, set passwords to never expire, as Microsoft recommends for cloud accounts.
• Banned passwords: the global list in Microsoft Entra Password Protection applies automatically to all cloud accounts. A custom list (up to 1,000 terms: company name, brands, city) requires a Microsoft Entra ID P1 or P2 licence, included in Microsoft 365 Business Premium.
• On-premises Active Directory: Entra Password Protection agents installed on domain controllers apply the same lists to on-premises password changes, under a P1 or P2 licence.
• Multi-factor authentication: mandatory registration for everyone, favouring the authenticator app or passkeys over SMS. Our MFA rollout guide details the method.
• Self-service password reset: paired with MFA, it prevents the helpdesk from resetting a password on a simple phone call, a common impersonation technique.
• Local admins on computers: Windows LAPS gives each computer a unique, rotated administrator password, managed from Intune or Active Directory, see Microsoft Intune for SMBs.

These settings add to those described in secure Microsoft 365 in 10 settings. In Google Workspace, the equivalent is set in the admin console (minimum length, enforced 2-step verification).

The business password manager

Single sign-on (SSO) covers more and more applications, but there are always separate accounts: supplier portals, government platforms, banks, company social media, network devices. That is where a business password manager becomes essential. It generates a long, unique password for each account, fills it in automatically, and lets you share access without ever sending it by email.

Selection criteria

Criterion	Why it matters
On-device encryption (“zero knowledge”)	The vendor cannot read your passwords, even if its servers leak
Shared vaults or collections per team	Each department only accesses its own accounts
Group management and directory integration	Rights follow arrivals, moves and departures
Multi-factor authentication to open the vault	The master password alone is not enough
Event log	Know who viewed, changed or shared a secret
Admin account recovery	An employee who forgets their master password does not lock the team out
Enforced policies	Master password length, export ban, automatic lock
Apps and extensions	Windows, macOS, browsers, Android and iOS

Several vendors offer business plans covering these points, for example Bitwarden, which documents shared collections, event logs and admin account recovery in its Teams and Enterprise plans. We check the features available in the intended plan before recommending a tool: they vary from one plan to another.

Why not the browser?

Browsers save passwords, and that is better than reuse. But they offer no controlled team sharing, no access log and no way to take back access when an employee leaves, and they expose every password on a shared computer to whoever sits down at it. In a business, we recommend turning off browser password saving once the manager is deployed.

Rolling out a password manager step by step

1. Inventory: list shared accounts (supplier portals, banks, social media, devices) and where their passwords are kept today.
2. Vault structure: one vault per team (accounting, sales, management, IT), with named owners.
3. Pilot: the IT team and a volunteer department migrate their accounts, then the structure is adjusted.
4. Rollout: short training per department, account migration, shared passwords changed along the way.
5. Clean-up: delete spreadsheets and notes, turn off browser password saving.
6. Review: regular review of vault access rights and the event log.

Awareness goes hand in hand with the rollout: an employee who understands why a long passphrase is required adopts it more readily. We combine it with our phishing awareness training program.

The most common mistakes

1. A “passwords” spreadsheet on the file server or in a shared folder: the first thing an attacker looks for.
2. The same password for all shared accounts, or a password built on the company name.
3. Default device passwords (firewall, phone system, printers, cameras) never changed.
4. Former employees’ accounts still active, or shared passwords never changed after they left.
5. A password sent by email or WhatsApp “to help out”, which then stays in message histories.
6. A policy without multi-factor authentication: a long password does not protect against a fake sign-in page.

The Moroccan framework

Law 09-08 requires you to secure the personal data you process, and protected access is a basic condition of that, see Morocco’s data protection law 09-08. For organisations covered by law 05-20 on cybersecurity, access management is part of the expected measures, as we explain in law 05-20 and the DGSSI.

Checklist

• One-page written policy, approved by management and shared with everyone.
• Minimum length raised, periodic expiration turned off.
• Banned password list active, with company-specific terms.
• Mandatory multi-factor authentication and self-service reset.
• Password manager deployed, vaults per team, logging enabled.
• Separate admin accounts, Windows LAPS on computers.
• Default passwords changed on all devices.
• Departure procedure: accounts disabled and shared secrets changed the same day.

How we work

We start with a free initial audit of your access: Microsoft 365 or Google Workspace accounts, multi-factor authentication, admin accounts, device passwords, where shared secrets are kept. We then write your policy, apply the settings, roll out the password manager department by department and train the teams. Suspicious sign-ins are watched by our 24/7 monitoring team, and a critical incident is handled in under 15 minutes, as part of our managed IT services in Morocco.

As a Microsoft partner, we configure Microsoft Entra ID and Intune to enforce these rules. Request your free initial audit: we reply within 24 business hours.