Azure Compliance ControlsAzure Virtual Machines
Windows machines should prohibit reuse of the previous 24 passwords
Requires that prerequisites are deployed to the policy assignment scope. Machines are non-compliant if Windows machines allow re-use of the passwords after the specified number of unique passwords. Default value for unique passwords is 24.
What this control checks
Windows machines must prevent reuse of the previous 24 passwords
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5(1) Password-Based Authentication
- 3.5.8: Prohibit password reuse for a specified number of generations.
- IA.L2-3.5.8 Prohibit password reuse for a specified number of generations
- Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
- Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_restrict_previous_24_passwords_resuse_windows - Powerpipe Control:
azure_compliance.control.compute_vm_restrict_previous_24_passwords_resuse_windows - Azure Policy Definition:
5b054a0d-39e2-4d53-bea3-9734cad2c69b
Last reviewed: 2026-10-11