Windows machines should have minimum password age set to 1 day
Requires that prerequisites are deployed to the policy assignment scope. Machines are non-compliant if Windows machines do not have the minimum password age set to specified number of days. Default value for minimum password age is 1 day.
What this control checks
Windows machines that do not meet the password age setting are non-compliant.
Common pitfalls
Prerequisites must be deployed to the assignment scope
The policy requires that prerequisites are deployed to the policy assignment scope.
Monthly charge applies per Arc connected machine
By selecting this option, you agree to be charged monthly per Arc connected machine.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit Windows machines that do not have the minimum password age set to specified number of days" (237b38db-ca4d-4259-9e47-7882441ca2c0); PowerPipe control azure_compliance.control.compute_vm_min_password_age_1_day_windows.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to IA-5(1) (Password-based Authentication).
FedRAMP Moderate Baseline Rev 4: Mapped to IA-5(1) (Password-Based Authentication).
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5(1) Password-Based Authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_min_password_age_1_day_windows - Powerpipe Control:
azure_compliance.control.compute_vm_min_password_age_1_day_windows - Azure Policy Definition:
237b38db-ca4d-4259-9e47-7882441ca2c0
Last reviewed: 2026-10-11