Security Policy Errors

How to Set a 180-Day Password Expiration Policy for Microsoft 365 Administrators

Huma Ashraf Ch Oct 13, 2026 868 views

Question details

The organization needs to configure a 180-day password expiration policy for global administrator accounts created solely in Microsoft Entra ID, without affecting the 90-day policy applied to on-premises synchronized users.

How to Set a 180-Day Password Expiration Policy for Microsoft 365 Administrators

Product: Microsoft 365
Device & OS: not provided
Scenario: Administering separate password expiration policies for cloud-only administrators and on-premises synchronized user accounts.
Observed behavior: Synchronized accounts currently follow the 90-day on-premises Active Directory policy, but the cloud-only admin accounts require a customized 180-day password rotation schedule.

Before you start

Ensure you are signed in to Microsoft 365 with Global Administrator credentials and verify that your regular users are properly synchronized from an on-premises Active Directory so their password rules remain unaffected by cloud changes.

Solution 1Recommended

Configure the Cloud Password Expiration Policy via Microsoft 365 Admin Center

Because synchronized users are governed by your on-premises Active Directory (AD) policies, setting the Microsoft 365 tenant password expiration will seamlessly apply only to your cloud-only accounts, such as your Global Administrators.

By default, passwords for synchronized users are managed on-premises and are set to 'never expire' in the cloud to prevent conflicts. Therefore, modifying the Microsoft 365 tenant password expiration policy acts as a targeted policy for your cloud-only accounts.

Access the Admin Center

Navigate to Security Settings

In the left navigation menu, go to 'Settings' and then select 'Org settings'.

Locate the Password Policy

Click on the 'Security & privacy' tab at the top of the page, then select 'Password expiration policy' from the list.

Set the 180-Day Expiration

Check the box that says 'Set user passwords to expire after a number of days'. Enter '180' in the 'Days before passwords expire' field.

Save and Test

Click 'Save' to apply the changes. It is recommended to create a test cloud-only account to verify that the 180-day policy is actively enforcing.

Configure the Cloud Password Expiration Policy via Microsoft 365 Admin Center

Configuration Successful: Your cloud-only administrator accounts are now subject to the 180-day expiration policy, while synchronized users remain on the 90-day AD policy.

Solution 2

Manage Individual Expiration Rules via Microsoft Graph PowerShell

If you need granular control to manually force expiration settings or set specific cloud administrator accounts to never expire, you can manage individual password policies using PowerShell.

Free Microsoft Office alternative

Document Your Organization's IT Security Policies with WPS Office

While Microsoft 365 handles your active directory and tenant security settings, WPS Office provides a fully compatible, lightweight, and cost-free alternative for drafting, managing, and distributing your organization's IT manuals and security policies.

1. Download and Install: Get the free WPS Office suite from the official website and install it on your workstation.
2. Draft Security Policies: Open WPS Writer to create or edit your internal password management guidelines and security protocols.
3. Export as Secure PDF: Use the built-in PDF export feature to lock your policy documents before distributing them to staff.

Completely free to use with a highly intuitive, familiar interface.High format compatibility with Microsoft Word, Excel, and PowerPoint (.docx, .xlsx, .pptx).Lightweight architecture ensures fast performance on Windows, Mac, and Linux systems.Built-in PDF toolkit makes it easy to secure, watermark, and distribute final IT policy documents.

microsoft office alternative - wps office

Frequently Asked Questions

Will changing the Microsoft 365 password expiration policy affect my on-premises users?

No. Users synchronized from an on-premises Active Directory have their passwords managed on-premises. The cloud expiration policy only applies to cloud-only accounts, such as Microsoft Entra ID native accounts.

Can I set different password expiration days for different cloud-only users?

Microsoft 365 allows only one global password expiration policy for the entire tenant. However, you can use PowerShell to exempt specific users from this policy by setting their passwords to never expire.

What happens to administrators when their password reaches the 180-day limit?

Upon attempting to log into Microsoft 365 or Microsoft Entra ID services after the 180-day mark, the administrator will be prompted to create a new password before they can access their account.

How can I verify if an admin account is cloud-only or synchronized?

In the Microsoft 365 admin center, go to Active users. Look at the 'Sync status' column. Cloud-only accounts will display an 'In cloud' icon, while synchronized users will show a 'Synced from on-premises' icon.

Microsoft Office Security Issues