Office
365 supports two types of identity:
1. Microsoft
Online Services cloud IDs:
Users have cloud credentials that are used to sign in to Office 365 services. These credentials are separate from any
desktop or corporate credentials. Office
365 issues these identities and hence also authenticates users. In this case the password policy is stored in
the cloud with the Office 365 servisse.
2.
Federated
IDs: Users use their
corporate AD credentials to sign in to Office 365 services. In this case a user’s corporate AD
authenticates the users and password policy is controlled and stored in the
on-premise AD.
This article describes the password policies and options for
Microsoft Online Services cloud IDs.
Password policy
|
Property
|
Description
|
|
Password restrictions
|
8 characters minimum and 16
characters maximum
Values
allowed:
·
A-Z
·
a-z
·
0-9
·
! @
# $ % ^ & * - _ + = [ ] { } | \ : ‘ , . ? / ` ~ “ < > ( ) ;
·
No
UNICODE
Cannot contain the username alias (part before @ symbol)
|
|
Password expiry duration
|
This is set to 90 days and is not configurable
|
|
Password expiry
|
By default password expiry is
enabled. If enabled, users will be
forced to change their passwords after 90 days. Users do not currently receive any form of
password expiry notification.
At
GA,
administrators will be able to enable/disable this setting through the
PowerShell Client (Microsoft Online Services Module for Windows PowerShell),
at the user level.
|
|
Property
|
Description
|
|
Password strength
|
Strong passwords require 3 out of 4 of the following:
·
Lowercase characters
·
Uppercase characters
·
Numbers (0-9)
·
Symbols (see password restrictions
above)
Strong
passwords will be required in BPOS when the new password policy takes effect.
There is a
setting in Office 365 which can remove the strong password requirement, but
this setting can only be modified after the customer is transitioned from
BPOS to Office 365.
At
GA, administrators will be able to
enable/disable this setting through the Microsoft Online Services Module, at
the user level.
|
|
Password history
|
Last password cannot be used again
|
|
Password history duration
|
None
|
|
Account lockout
|
After 10 unsuccessful logon
attempts (wrong password), the user will need to solve a CAPTCHA dialog as
part of logon.
After a further 10 unsuccessful logon attempts (wrong
password) and correct solving of the CAPTCHA dialog, the user will be locked
out for a time period. Further
incorrect passwords will result in an exponential increase in the lockout
time period.
http://community.office365.com/en-us/wikis/upgrade/password-management.aspx |
