Advanced Password Policies For Increased Security

Blog / Advanced Password Policies For Increased Security

When it comes to protecting users’ mail accounts, a strong password is the first line of defense. As such, organizations have different conditions for their users’ passwords. Google Workspace administrators can already specify minimum and maximum password length limits for their users. With this launch, we are making it possible to implement additional stringent password requirements for increased security and to meet their compliance requirements.

Going forward, an administrator can do the following:

Requires that the user set a strong password.

Admins can already see which passwords are weak in their domains; Enabling this setting will allow administrators to force users with weak passwords to change them.

Note that this setting is off by default.

Control when password length and strength requirements go into effect.

You can choose to enforce password length and strength requirements the next time a user changes their password or the next time they log in. By default the enforcement has to start the next time a user changes their password. To change this, check the box next to “Start password policy enforcement on next sign in.”

Prompt users to change their passwords after a certain number of days.

If you’re unsure about whether or not you need to do this, we recommend you leave this setting as “Never.”

Prevent users from reusing old passwords.

To prevent password reuse, we recommend you leave the box for “Allow password reuse” unchecked. This is the default.

Each of these settings can be found in the Admin console under Security > Password management.

As part of the launch we are also moving the password length (minimum and maximum) settings from the Basic Settings card to this new Password management card.