Ridiculous Password Requirements for Office 365 email

[zag]

Is anyone else having a problem with this? The new password restrictions for Exchange Online are overly complicated.

 

- Use of uppercase letter

- Use of number

- Use of 8 characters long

 

I mean come on, thats just over the top Anyone know a way of changing the requirements?

 

At the moment I am resetting everyones password using the admin console which seems to allow 6 letter passwords. The younger kids just cant remember such complicated passwords.

[Blue_Cookeh]

As far as I know, no. This was introduced with the Live@Edu > Office365 for Education migration. How are you resetting their passwords and keeping them? I thought that as soon as the user logged in with the reset password it asked them to change it?

 

I don't see it as a bad thing to be honest and actually set our security policy to this for staff...

[sted]

As far as I know, no. This was introduced with the Live@Edu > Office365 for Education migration. How are you resetting their passwords and keeping them? I thought that as soon as the user logged in with the reset password it asked them to change it?

 

I don't see it as a bad thing to be honest and actually set our security policy to this for staff...

 

my problem with secure passwords is that people just write them down on a bit of paper/diary so ive found them in real use less secure

[Willott]

I feel this is the time for:

 

[nadeem]

As far as I know, no. This was introduced with the Live@Edu > Office365 for Education migration. How are you resetting their passwords and keeping them? I thought that as soon as the user logged in with the reset password it asked them to change it?

 

I don't see it as a bad thing to be honest and actually set our security policy to this for staff...

 

When resetting passwords you can choose whether to make the user change this on login

[localzuk]

I feel this is the time for:

 

[ATTACH=CONFIG]15107[/ATTACH]

 

Demonstrably false. A simple dictionary attack could stomp its way through that second password in no time.

[zag]

I've had nearly 50 students come to me in the last few days who have forgotten their passwords. Last year I probably had less than 5.

 

I enter in their password manually which can be 6 character passwords if you use the admin console.

[m25man]

I dont think you can shorten the password but you can set it not to expire using powershell.

[Sylv3r]

Does the ADFS or whatever the AD synchronisation tool not restrict the user to having passwords without the complex policy? We currently use Live@Edu and are looking to move to Office 365 with the AD linked together, currently our passwords need to be longer than 6 characters to sync, but I may need to think twice over the migration if the complexity of the user passwords will need to change again.

[zag]

Demonstrably false. A simple dictionary attack could stomp its way through that second password in no time.

 

As far as I know... there is no tool available to "dictionary attack" Office 365.

 

I believe it locks your account after a certain number of password fails too.

 

Its a classic case of making passwords so complicated, they become less secure because no one can remember them

Edited September 11, 2012 by zag

[Michael]

When you bulk import users using a CSV, you could specify random 6 numbered passwords (this is how I do it), but do not force the user to change their password. Provide instructions giving them the option to do so.

 

Just write a small excel formula to generate the random numbers.

Edited September 11, 2012 by Michael

[zag]

Cool that's a really good idea! Hadn't thought of that.

 

I have no problem with a random shorter password. I guess its the fact I was letting the kids choose their own password thats the problem.

 

Thanks.

[chazzy2501]

Demonstrably false. A simple dictionary attack could stomp its way through that second password in no time.

 

147000 words in a dictionary 147000 x 147000 x 147000 x 147000 and that is assuming you know how the password is put together! But the point is you don't know how someone has put their password together so to brute force you have to do by character.

 

I use simple sentences "i like to eat cake on friday"

[twin--turbo]

They are just enforcing the standard 2k8 domain password policy

 

Rob

[PiqueABoo]

Haven't looked at it's effect so don't know if it works, but the set-msoluser cmdlet has a StrongPasswordRequired switch in addition to the one I was setting to $true (PasswordNeverExpires).

[AngryTechnician]

As an aside, Google Apps has a similar problem. The requirements aren't as strict (8 characters), but they are a problem for some younger pupils.

 

Again, you can ignore them in the admin panel or by syncing a password hash using Google Apps Directory Sync, but if you try to set the password via the normal password change screen, or using the Provisioning API, you have to use 8 chars or more.

 

The fact is that neither Office 365 nor Google Apps for Education are actually designed for schools. They are business services that happen to work well for higher education, but have issues in secondary and even more issues in primary.

[fairm010]

NECRO THREAD! Sorry, thought it better to tag on here than make a new one.

 

Did you ever find a solution to this? I have just followed the instructions on this how can I disable password complexity and expiration for a particular security group or license type? | Manage Office 365 | Microsoft Office 365 Community page but it no worky!

[djones]

We (Primary school) don't find passwords an issue once complexity has been disabled but what really makes life hard is having to enter the @domain after the username. Ours is long and this is a deal breaker at the moment.

[fairm010]

Did you disable complexity via powershell? Has it taken effect? It also says that every password reset needs to be done via powershell to be simple. So much hassle! Im now looking into DirSync to sync with my onsite AD.

[EduTech]

Hi,

 

You can configure your Office 365 to use Simple Passwords, and you can lock this down to 'Groups'. You can met this requirement by running PowerShell CMDLETS. please refer to the following article to install PowerShell and get connected to Office 365.

 

Manage Windows Azure AD using Windows PowerShell

 

If you want to achieve the requirement for a set of users, you can add the users into a security group. Then run the following command to get object ID for the group.

 

Get-MsolGroup

 

After that, run the following command to disable strong password for the users in this group.

 

Get-MsolGroupMember -groupObjectid | Set-MsolUser -StrongPasswordRequired $False

 

=========

 

If you want to manage your Password Policy i.e to match your domain password policy then please look at introducing DirSync w/ Password Sync or/ Active Directory Federation Service

 

I hope that helps,

James.

[fairm010]

Cheers James, I have ran that to apply to all users. I am just dumbfounded that passwords need to be set through Powershell if they are to be simple!

 

Im having trouble now where I run this

 

Set-MsolUserPassword –UserPrincipalName [userPrincipalName]–NewPassword [NewPassword]

 

To change the password but I dont know what UserPrincipleName is.

[EduTech]

Cheers James, I have ran that to apply to all users. I am just dumbfounded that passwords need to be set through Powershell if they are to be simple!

 

Im having trouble now where I run this

 

Set-MsolUserPassword –UserPrincipalName [userPrincipalName]–NewPassword [NewPassword]

 

To change the password but I dont know what UserPrincipleName is.

 

Hi Mate,

 

It will be the USER ID in the portal and will be something like [email protected] or @domain.sch.uk /etc

 

James.

[AngryTechnician]

Cheers James, I have ran that to apply to all users. I am just dumbfounded that passwords need to be set through Powershell if they are to be simple!

Microsoft's philosophy for a few years now has been that they don't need to make a GUI for anything except the most common admin tasks. Even the GUI they do have on some newer products is actually just a wrapper that generates and runs PowerShell commands (e.g. Exchange Management Console, which is why it's so slow compared to ADUC).

 

It started about the same time Serve Core was introduced. I find it infuriating too, but that's they way it is. It could be worse, Google hide all their best functionality in an API so you have to cut your own code to do anything that isn't in the web admin console.

Edited March 12, 2014 by AngryTechnician

[fairm010]

So their email address? Or something M$ specific?

 

Would you recommend using dirsync in this instance? how straight forward is it to get going?

 

I don't want to be administering password resets via powershell all the time.

[EduTech]

So their email address? Or something M$ specific?

 

Would you recommend using dirsync in this instance? how straight forward is it to get going?

 

I don't want to be administering password resets via powershell all the time.

 

You would of set this when you uploaded your users, If you login to the portal > users and groups > the user list will show the 'DisplayName. Username. Status' the Username is the UPN Value.

 

In terms of what I would recommend, It's hard to say without knowing more about your organization but Directory Sync is obviously a much more automated way of provisioning user objects in windows azure active directory & updating passwords for a single identity / single set of creds approach.

 

James.