Arghhhh – AGAIN?

If your company uses Office365 (Exchange Online), I am sure you’ve had reactions like the one above several times in your life. Every 90 days actually.

90 days is the default Password Expiration Policy for Office365 (shorter than the 42 days of Active Directory) and this affects CRM Online.

I get this question all the time: “Is there any way we can extend the expiration time for CRM Online?”

Absolutely!

I’ve been a Certified Ethical Hacker since 2005 (It’s a real thing, look it up :)), and I can tell you that these expiration settings offer very little protection, in my opinion. Most “password attacks” are based on Social Engineering, and most people (including “IT Experts”) rotate the same 2 or 3 passwords every time they are asked to change it. I bet you do too. We all do.

These Password Expiration policies were created based on time estimates of how long it would take for a super computer to decode the hash (unicodePwd in Active Directory) and get everyone’s password. So the idea is that by requiring people to change their password every 6 weeks they won’t get any good passwords if they are able to decrypt the hash. Some companies even apply “password history” policies where you are unable to use any of your last 15 passwords or something along those lines to “increase security”. Most people just end up increasing a number within their password by one and calling it a day.

So, nowadays it seems that more and more organizations are agreeing with my thoughts on this subject and requesting an increase on the expiration policy.

After you make sure that your organization supports the change, follow these steps to increase the expiration policy in Office365:

1. Open the Office365 Admin Portal (https://portal.office.com):

2. Navigate to the Active Users Tab, and then click on “Change now” on “Change the password expiration policy for your users”:

 

3. Type the number of days before the password should expire. Choose a number of days from 14 to 730. Click Save.

 

Your new password expiration policy has been set!

---

What do you think about this tip?

Do you have any comments on the “Accepted wisdom” of password expiration policies?

Drop us a line here – we would love to hear your feedback!