Users with passwords not changed in last 6 months

Last updated Oct 17, 2026 Policies Access & Sharing

AI summary

Users who have not changed their password for more than 6 months present increased security risks; unchanged credentials may go undetected after compromise and allow persistent unauthorized access. Rencore Governance identifies these accounts so you can enforce immediate password changes and implement regular password expiration policies.

Severity: Medium Security Generally available

What it detects

Shows users that have not changed their password for more than 6 months.

Why it matters

Unchanged passwords increase breach risk as credential compromise may go undetected for extended periods, allowing persistent unauthorized access. Enforce immediate password changes for all users exceeding six months, implement regular password expiration policies aligned with security best practices, and consider transitioning to passwordless authentication methods for enhanced security and user experience.

The rule

Every User where Last password change date is more than 6 months ago and Is External is false

In Rencore Governance

Details

Applies to	User
Connector	Microsoft 365
Severity	Medium
Category	Security
Recommended	No
Recommended automation	None
License type	Standard

Other policies that check User objects:

Copilot adoption opportunity - E3/E5 users (Medium)
Copilot license assigned to disabled account (High)
Inactive Copilot users - 30 days (Medium)
Excessive draft agent creation pattern (Medium)
External users (Information)
External users with pending acceptance (Low)
Users with Power Platform Premium license (Information)
Users with E3 license not using Outlook in last 12 month (Low)
Disabled user accounts (Medium)
Admin accounts with an Office 365 E3 license assigned (Medium)
Administrators without MFA (High)
External users invited 3 month ago with pending acceptance (Low)
Disabled user accounts with assigned licenses (High)
Global administrators without MFA (High)
Guest users with a Dynamics license assigned (Medium)
Inactive external users (Medium)
Inactive internal users (Medium)
Over-licensed user accounts (High)
Users who are creating Microsoft Loop Teams components (Medium)

Frequently asked questions

What does the users with passwords not changed in last 6 months policy detect?

The Users with passwords not changed in last 6 months policy shows users that have not changed their password for more than 6 months.

Which objects does the users with passwords not changed in last 6 months policy check?

The Users with passwords not changed in last 6 months policy checks User objects from the Microsoft 365 inventory and reports each one that matches its rule as a violation.

How severe is a violation of the users with passwords not changed in last 6 months policy?

Violations of the Users with passwords not changed in last 6 months policy have Medium severity. The policy is in the Security category.

Which module includes the users with passwords not changed in last 6 months policy?

The Users with passwords not changed in last 6 months policy comes with the Microsoft 365 connector in the Digital Workplace module of Rencore Governance, which every Plan includes.

Was this page helpful?