Windows machines should have minimum password length set to 14 characters
Checks the minimum password length setting on Windows machines in the policy assignment scope. The default value for minimum password length is 14 characters. The `Guest Configuration` prerequisites must be deployed to the policy assignment scope first.
The Minimum password length setting determines the least number of characters that can make up a password for a user account.
What this control checks
Minimum password length policy on Windows machines, set to 14 characters
Common pitfalls
Prerequisites must be deployed to the scope
Requires that prerequisites are deployed to the policy assignment scope.
Arc connected servers are not included by default
By selecting this option, you agree to be charged monthly per Arc connected machine.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit Windows machines that do not restrict the minimum password length to specified number of characters" (a2d0e922-65d0-40c4-8f87-ea6da2d307a2); PowerPipe control azure_compliance.control.compute_vm_min_password_length_14_windows.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to IA-5(1) (Password-based Authentication).
FedRAMP Moderate Baseline Rev 4: Mapped to IA-5(1) (Password-Based Authentication).
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5(1) Password-Based Authentication
- 3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- IA.L2-3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
- Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_min_password_length_14_windows - Powerpipe Control:
azure_compliance.control.compute_vm_min_password_length_14_windows - Azure Policy Definition:
a2d0e922-65d0-40c4-8f87-ea6da2d307a2
Last reviewed: 2026-10-11