Password policy

how-to · Reviewed 2026-11-02 GA

Complexity and rotation rules for Rescale passwords. These settings are organization-level only, with no per-workspace override.

Not needed if you use SSO

With SSO, your identity provider owns password rules and this page does nothing. It matters for organizations where members sign in with a Rescale password, and for any accounts that fall outside your IdP.

Where it is

Organization Admin > Security > Password Policy. Only organization administrators can reach it: see which portal holds what.

What you can set

The policy is off until you enable it, and it then governs two independent things: how strong a password has to be, and how long it may live. Complexity rules are checked when a password is set. Age and reuse rules govern when it may or must be replaced, and they interact with each other in a way worth understanding before you fill the fields in.

Complexity

Setting	Effect
Minimum password length	The floor, in characters
Require at least one uppercase letter	A–Z
Require at least one lowercase letter	a–z
Require at least one number	0–9
Require at least one punctuation character	Symbols

Age and reuse

Setting	Effect
Minimum password age in days	How long before a password can be changed again
Automatically expire passwords	Turns on forced rotation
Maximum password age in days	How long before a password must be changed
Minimum password generations before reuse	How many distinct passwords before an old one may return

Minimum password age is the setting most often misread. Its job is to stop a user cycling through several changes in one sitting to arrive back at a password they have used before, which is what makes the reuse-generations count mean anything. Without it, a policy demanding five generations before reuse costs a determined user about a minute.

Keep the minimum age below the maximum age

The two age settings have to leave a window between them. If the minimum age is equal to or greater than the maximum, a password becomes changeable only at or after the point it has already expired, and users meet a forced change they cannot complete.

Set the minimum to a small fraction of the maximum. A 90-day maximum with a one-day minimum behaves sensibly; a 90-day maximum with a 95-day minimum does not.

When it takes effect

Existing passwords aren't retroactively validated

The policy is enforced on new signups and password changes. Enabling it does not force everyone to re-set their password immediately.

To rotate existing passwords, also enable Automatically expire passwords with a maximum age. Users are then prompted as their current password ages out.

Choosing a policy

Length does more for security than character-class rules, and aggressive rotation tends to produce weaker, more predictable passwords. If you have latitude:

Instead of	Consider
Short password plus every character class	A longer minimum length
30-day forced rotation	A longer maximum age, plus MFA
Password rules generally	SSO, which moves this to your IdP

MFA is required for users whose organization doesn't use SSO, so a password is never the only factor. Weigh rotation aggressiveness with that in mind.

Related

• Single sign-on — the alternative to managing passwords here
• Multi-factor authentication — required for non-SSO users
• User lifecycle — invitations and admin rights
• Organizations and workspaces — why this is org-level