Microsoft says it will drop password expiration policies with the Windows 10 May 2019 Update, suggests organizations implement other password security practices
Sergiu Gatlan / BleepingComputer :
Context & Ripple Effects
This move is the endpoint of a deliberate sequence rather than a one-off policy change: Microsoft first enabled password-less logins via the Microsoft Authenticator app for Azure AD-connected apps in September 2018, then shipped Windows Hello's FIDO2 certification in the same May 2019 update that kills expiration policies (ZDNet). The company had already built the replacement before removing the old control.
The arc since then validates the bet — Microsoft later reported roughly 200 million users on passwordless login when it introduced Temporary Access Pass in March 2021, and by 2025 it made new accounts passwordless by default. The expiration-policy removal was the first structural concession that rotating passwords on a schedule creates weaker security postures than replacing passwords outright.
First-order effects
- IT administrators managing Windows 10 via Group Policy lose scheduled password expiry as a default compliance lever and must instead adopt Microsoft's recommended alternatives — length requirements, breach monitoring, and multi-factor authentication.
Second-order effects
- Security vendors selling rotation-based compliance tooling face pressure to reposition toward MFA, passkeys, and credential-monitoring products as the flagship Microsoft OS stops enforcing the practice their audits were built around.
- Microsoft's own authentication stack — Authenticator, Windows Hello, Azure AD — becomes the path of least resistance for organizations dropping expiration, deepening lock-in to Microsoft identity services.
Third-order effects
- If the pattern holds, password hygiene shifts from user-behavior mandates (rotate, memorize) to infrastructure-level replacement (passkeys, biometrics), a trajectory Microsoft itself completed six years later with passwordless-by-default accounts. The residual risk moves to legacy protocols: researchers flagged in 2025 that Windows RDP still accepts revoked or changed passwords, showing that deprecating passwords unevenly leaves the oldest doors open longest.
The trend: Authentication is migrating from periodic password rotation toward password elimination entirely, with Microsoft moving from optional alternatives in 2018-2019 to defaults a half-decade later.