Rules/DOM-001.password-expiry-disabled.psd1
|
@{ Id = 'DOM-001' Title = 'Password expiration is disabled' Area = 'TenantBasics' Severity = 'Low' References = @( 'CIS Microsoft 365 Foundations Benchmark (password expiration policy)' 'https://learn.microsoft.com/microsoft-365/admin/misc/password-policy-recommendations' ) Rationale = 'Forced password rotation produces predictable increments and sticky notes; NIST and Microsoft recommend no expiry combined with MFA and breach detection.' Remediation = 'Set the password validity period to never expire (Set-MsolPasswordPolicy / admin center) and rely on MFA plus risk-based controls instead.' Test = { param($Snapshot) $verifiedDomains = @($Snapshot.TenantBasics.domains | Where-Object { $_.isVerified }) $withPolicy = @($verifiedDomains | Where-Object { $_.PSObject.Properties['passwordValidityPeriodInDays'] -and $null -ne $_.passwordValidityPeriodInDays }) if ($withPolicy.Count -eq 0) { return New-TLRuleResult -Status Manual -Evidence 'passwordValidityPeriodInDays not present in the snapshot (older TenantLens or missing permission).' } $expiring = @($withPolicy | Where-Object { [long]$_.passwordValidityPeriodInDays -lt 730 }) if ($expiring.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence @($expiring | ForEach-Object { "{0}: passwords expire after {1} days" -f $_.id, $_.passwordValidityPeriodInDays }) } else { New-TLRuleResult -Status Pass -Evidence 'Passwords are set to never expire (or a multi-year validity).' } } } |