{"id":34280,"date":"2026-02-13T07:19:15","date_gmt":"2026-02-13T07:19:15","guid":{"rendered":"https:\/\/help.desk365.io\/en\/?post_type=docs&p=34280"},"modified":"2026-05-09T09:46:03","modified_gmt":"2026-05-09T09:46:03","slug":"custom-password-policy-in-desk365","status":"publish","type":"docs","link":"https:\/\/help.desk365.io\/en\/articles\/custom-password-policy-in-desk365\/","title":{"rendered":"Custom password policy in Desk365"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t
\n Available with:<\/span>\n \n \n \n <\/circle>\n <\/path>\n <\/svg>\n Standard<\/span>\n <\/span>\n \n |<\/span>\n \n \n \n <\/circle>\n <\/path>\n <\/svg>\n Plus<\/span>\n <\/span>\n \n |<\/span>\n \n \n \n <\/circle>\n <\/path>\n <\/svg>\n Premium<\/span>\n <\/span>\n<\/div>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

The\u00a0custom\u00a0password policy\u00a0feature in Desk365 allows administrators to define secure password rules and session settings for both the agent portal\u00a0and the\u00a0support portal. This helps ensure consistent security standards across your helpdesk while giving you control over password complexity,\u00a0expiration, and session timeouts.<\/span>\u00a0<\/span><\/p>

This article explains how the\u00a0password\u00a0policy works and walks you through setting it up step by step.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t

Who can configure custom password policy? <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Only\u00a0a<\/span>dmins\u00a0or\u00a0agents\u00a0with permission\u00a0to the settings tab\u00a0can access and update password policy settings.\u00a0<\/span>Once updated, the policy applies\u00a0immediately\u00a0to all relevant users.<\/span>\u00a0<\/span><\/p>

To find password policy settings:<\/span>\u00a0<\/span><\/p>

  • Go to Settings<\/span>\u00a0<\/span><\/li>
  • Navigate to Security and Compliance<\/span>\u00a0<\/span><\/li>
  • You can configure password policies under, Agent Authentication > Password Requirements, for agents<\/span> and Contact Authentication > Password Requirements, for contacts<\/span>\u00a0<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"password-policy-configuration-for-agents-and-contacts-in-desk365\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t

    With\u00a0password\u00a0policy, you can:<\/span>\u00a0<\/span><\/p>

    • Define\u00a0password complexity requirements<\/span>\u00a0<\/span><\/li>
    • Set\u00a0minimum\u00a0password length<\/span>\u00a0<\/span><\/li>
    • Enforce\u00a0password\u00a0expiration<\/span>\u00a0<\/span><\/li>
    • Prevent\u00a0password reuse<\/span>\u00a0<\/span><\/li>
    • Automatically log users out when policies are updated<\/span>, on next login, or upon a voluntary password change.<\/span>\u00a0<\/span><\/li><\/ul>

      You can also set up the session\u00a0<\/span>expiration<\/span>\u00a0under Session Configuration<\/span>, from<\/span>\u00a0here you can control how long agents stay logged in before they are automatically signed out.<\/span><\/span>\u00a0<\/span><\/b><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"session-configuration-desk365-password-ploicy\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t

      Important\u00a0note:<\/strong><\/em>\u00a0<\/span>If your\u00a0agent\u00a0portal\u00a0is configured to use\u00a0Microsoft\u00a0sign-in, password rules defined here will not apply to agents. In this case, authentication is managed by Microsoft, and Desk365 password settings are disabled for the\u00a0agent\u00a0portal.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"password-policy-not-applicable-in-agent-portal-desk365\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t

      Configuring password policy for the agent portal <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t
      • Go to Security and Compliance > Agent Authentication > Password Requirements<\/strong><\/span><\/span>\u00a0<\/span><\/strong><\/li>
      • Under\u00a0password\u00a0requirements, configure the following:<\/span>\u00a0
        <\/span>1.\u00a0 Minimum password length<\/strong><\/span>\u00a0–\u00a0<\/span><\/b>Choose the minimum number of characters<\/span>\u00a0
        <\/span>2.\u00a0 Enable or disable password complexity rules:<\/strong><\/span>\u00a0
        <\/strong>–\u00a0 Require uppercase letters (A\u2013Z)<\/span>\u00a0
        <\/span>–\u00a0 Require lowercase letters (a\u2013z)<\/span>\u00a0
        <\/span>–\u00a0 Require numbers (0\u20139)<\/span>\u00a0
        <\/span>–\u00a0 Require special characters (such as <\/span>!@#$%^&*<\/span>)<\/span>
        <\/span>–\u00a0 Ensure the password is different from the user\u2019s email address<\/li><\/ul>

        These rules ensure strong and secure passwords.\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"password-policy-setup-agent-portal\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t
        • To enforce periodic password\u00a0<\/span>changes<\/span>\u00a0e<\/span>nable\u00a0<\/span>p<\/span>assword\u00a0<\/span>expires<\/span>\u00a0in<\/span>\u00a0and s<\/span>elect one of the available durations<\/span>\u00a0–\u00a0<\/span>30, 60, 90, 120, or\u00a0<\/span>150 days<\/span>.\u00a0<\/span>Agents will be prompted to reset their password once it expires.<\/span><\/span>\u00a0<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"agent-portal-password-expiry-setup-desk365\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
          \n\t\t\t\t
          \n\t\t\t\t\t\t\t
          • To prevent password\u00a0<\/span>reuse,<\/span>\u00a0e<\/span>nable\u00a0<\/span>\u2018<\/span><\/span>Should not be the same as last<\/span>\u2019\u00a0<\/span><\/span>and select how many <\/span>previous<\/span>\u00a0passwords cannot be reused (from 1 to 5).<\/span>\u00a0This prevents users from cycling back to old passwords.<\/span><\/span>\u00a0<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"ensuring-password-is-not-same-as-last-time-desk365\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
            \n\t\t\t\t
            \n\t\t\t\t\t\t\t
            • Finally, c<\/span>lick\u00a0<\/span>s<\/span>ave<\/span>\u00a0to apply the password policy<\/span><\/span>\u00a0<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t

              After configuring the password requirements configure the session settings under Agent Authentication > Session Configuration<\/strong>. Set how long an agent can stay logged in before being logged out automatically. This helps reduce risk from unattended or long-running sessions.<\/span><\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

              \n\t\t\t\t
              \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"agent-authentication-session-configuration\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t

              Configuring password policy for the support portal <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
              \n\t\t\t\t
              \n\t\t\t\t\t\t\t

              The\u00a0<\/span>s<\/span>upport\u00a0<\/span>p<\/span>ortal<\/span>\u00a0settings work the same way\u00a0<\/span>as the agent portal but\u00a0<\/span>apply to end users or contacts accessing your helpdesk.<\/span><\/span>\u00a0<\/span><\/p>

              1. Go to Security and Compliance > Contact Authentication > Password Requirements<\/strong><\/span><\/span><\/li>
              2. Configure:<\/span>\u00a0
                <\/span>– Minimum password length<\/span>
                <\/span>– Password complexity rules<\/span>\u00a0
                <\/span>– Password expiration<\/span>\u00a0
                <\/span>– Password reuse restrictions<\/span>\u00a0<\/span><\/li>
              3. Click\u00a0save<\/span>\u00a0<\/span><\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                \n\t\t\t\t
                \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"setting-password-requirements-contact-desk365\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                \n\t\t\t\t
                \n\t\t\t\t\t\t\t

                These rules ensure that customer and user accounts accessing the support portal also meet your security standards.<\/span><\/span>\u00a0<\/span><\/p>

                Similar to the agent\u00a0<\/span>portal,<\/span>\u00a0you can configure session settings for support portal users under Contact Authentication > Session Configuration<\/strong>, to control how long they stay logged in before being automatically signed out.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

                \n\t\t\t\t
                \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                \n\t\t\t\t
                \n\t\t\t

                What happens when a password policy is updated? <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                \n\t\t\t\t
                \n\t\t\t\t\t\t\t

                When an admin (or any authorized role) updates the password policy, how and when it takes effect depends on the\u00a0<\/span>option<\/span>\u00a0selected<\/span>.<\/span><\/span>\u00a0<\/span><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

                \n\t\t\t\t
                \n\t\t\t\t\t\t\t\t\t\t\t\t\t\"configuring-password-policy-application-desk365\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                \n\t\t\t\t
                \n\t\t\t\t\t\t\t
                • Immediately<\/span><\/b> – <\/span>All active users will be logged out within\u00a0a short time\u00a0frame (30 minutes) and will\u00a0be required\u00a0to reset their passwords to\u00a0comply with\u00a0the new policy before logging in again. This ensures\u00a0timely\u00a0compliance across the organization without requiring an instant logout.\u00a0<\/span><\/li>
                • On next login – <\/span><\/b>Users\u00a0remain\u00a0logged in until they log\u00a0out\u00a0or their session expires. The next time they\u00a0attempt\u00a0to log in,\u00a0they\u2019ll\u00a0be prompted to update their password according to the new policy.\u00a0<\/span><\/li>
                • On voluntary password change<\/span><\/b> – <\/span>The new policy is applied only when users choose to change their password. Existing passwords continue to work until a voluntary update is made.\u00a0<\/span><\/li><\/ul>

                  These options give admins full control over how quickly new password requirements are enforced, balancing security needs with user convenience.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

                  \n\t\t\t\t
                  \n\t\t\t

                  Points to remember <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                  \n\t\t\t\t
                  \n\t\t\t\t\t\t\t
                  • Password\u00a0policy applies to\u00a0both Agent Portal and Support Portal<\/span>\u00a0<\/span><\/li>
                  • Agent\u00a0portal password rules are\u00a0disabled if Microsoft sign-in is enabled<\/span>\u00a0<\/span><\/li>
                  • Similarly, when the support portal is configured to use only Microsoft sign-in, password policy rules are disabled for support users as well<\/span>\u00a0<\/span><\/li>
                  • Session\u00a0expiration\u00a0helps reduce unauthorized access<\/span>\u00a0<\/span><\/li>
                  • Password\u00a0expiration\u00a0and reuse rules improve long-term security<\/span>\u00a0<\/span><\/li>
                  • Policy changes trigger an automatic logout for all affected users<\/span>\u00a0<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                    \n\t\t\t\t
                    \n\t\t\t

                    Best practices <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                    \n\t\t\t\t
                    \n\t\t\t\t\t\t\t
                    • Use at least\u00a08\u201312 characters\u00a0for passwords<\/span>\u00a0<\/span><\/li>
                    • Enable all complexity requirements for better protection<\/span>\u00a0<\/span><\/li>
                    • Set password expiration to 90 days or less for agents<\/span>\u00a0<\/span><\/li>
                    • Combine password policy with SSO where possible for enterprise security<\/span>\u00a0<\/span><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
                      \n\t\t\t\t
                      \n\t\t\t\t\t\t\t

                      Password\u00a0policy in Desk365 plays a key role in meeting modern\u00a0security and compliance requirements\u00a0by ensuring controlled access, strong authentication, and consistent enforcement of password standards across your helpdesk.<\/span>\u00a0<\/span><\/p>

                      Automatic logout and mandatory password resets when policies change further support compliance with frameworks such as SOC 2 and HIPAA, where regular credential rotation, session control, and access governance are required. Together, these capabilities help organizations maintain a strong security posture while ensuring operational flexibility as teams and customer environments scale.<\/span>\u00a0<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"author":16,"featured_media":0,"parent":27663,"menu_order":4,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-34280","docs","type-docs","status-publish","hentry","no-post-thumbnail"],"comment_count":0,"_links":{"self":[{"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/34280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/comments?post=34280"}],"version-history":[{"count":43,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/34280\/revisions"}],"predecessor-version":[{"id":36837,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/34280\/revisions\/36837"}],"up":[{"embeddable":true,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/27663"}],"next":[{"title":"Setting up agent authentication","link":"https:\/\/help.desk365.io\/en\/articles\/agent-authentication\/","href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/36634"}],"prev":[{"title":"Encrypted field logs in Desk365","link":"https:\/\/help.desk365.io\/en\/articles\/audit-logs-in-desk365\/","href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/docs\/34273"}],"wp:attachment":[{"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/media?parent=34280"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/help.desk365.io\/en\/wp-json\/wp\/v2\/doc_tag?post=34280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}