Azure Compliance ControlsAzure Virtual Machines
Windows machines should have minimum password length set to 14 characters
Checks the minimum password length setting on Windows machines in the policy assignment scope. The default value for minimum password length is 14 characters. The `Guest Configuration` prerequisites must be deployed to the policy assignment scope first.
What this control checks
Minimum password length policy on Windows machines, set to 14 characters
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5(1) Password-Based Authentication
- 3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- IA.L2-3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
- Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_min_password_length_14_windows - Powerpipe Control:
azure_compliance.control.compute_vm_min_password_length_14_windows - Azure Policy Definition:
a2d0e922-65d0-40c4-8f87-ea6da2d307a2
Last reviewed: 2026-10-11