Azure Compliance ControlsAzure Virtual Machines
Windows machines should have the password complexity setting enabled
Requires that prerequisites are deployed to the policy assignment scope. Machines are non-compliant if Windows machines do not have the password complexity setting enabled. The Azure Policy check audits these machines.
What this control checks
Windows machines without the password complexity setting enabled are non-compliant.
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5(1) Password-Based Authentication
- 3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- IA.L2-3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- IA-5(1) Password-Based Authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_password_complexity_setting_enabled_windows - Powerpipe Control:
azure_compliance.control.compute_vm_password_complexity_setting_enabled_windows - Azure Policy Definition:
bf16e0bb-31e1-4646-8202-60a235cc7e74
Last reviewed: 2026-10-11