Azure Compliance ControlsAzure Virtual Machines
Windows machines should have maximum password age set to 70 days
Checks the maximum password age setting on Windows virtual machines using Azure Policy guest configuration. The Azure Policy default value for maximum password age is 70 days. Requires that prerequisites are deployed to the policy assignment scope.
What this control checks
Windows machines pass or fail based on their configured maximum password age policy
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5(1) Password-Based Authentication
- Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
- Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters
Related controls
- Windows machines should not store passwords using reversible encryption
- Linux virtual machines should have the Linux Guest Configuration extension installed for assignments
- Windows Azure Arc machines should have the Log Analytics extension installed
- Windows virtual machines should have the network traffic data collection agent installed
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_max_password_age_70_days_windows - Powerpipe Control:
azure_compliance.control.compute_vm_max_password_age_70_days_windows - Azure Policy Definition:
4ceb8dc2-559c-478b-a15b-733fbf1e3738
Last reviewed: 2026-10-11