I believe this has been Microsoft's guidance as far back as 2016, with the caveat of using Azure AD risk analysis /MFA.[1]
>Password expiration policies do more harm than good, because these policies drive users to very
predictable passwords composed of sequential words and numbers which are closely related to each
other (that is, the next password can be predicted based on the previous password). Password change
offers no containment benefits cyber criminals almost always use credentials as soon as they
compromise them.
>Mandated password changes are a long-standing security practice, but current research strongly
indicates that password expiration has a negative effect. Experiments have shown that users do not
choose a new independent password; rather, they choose an update of the old one. There is evidence to
suggest that users who are required to change their passwords frequently select weaker passwords to
begin with and then change them in predictable ways that attackers can guess easily.
>One study at the University of North Carolina found that 17% of new passwords could be guessed given
the old one in at most 5 tries, and almost 50% in a few seconds of un-throttled guessing. Furthermore,
cyber criminals generally exploit stolen passwords immediately.
[1]https://www.microsoft.com/en-us/research/wp-content/uploads/...
>Password expiration policies do more harm than good, because these policies drive users to very predictable passwords composed of sequential words and numbers which are closely related to each other (that is, the next password can be predicted based on the previous password). Password change offers no containment benefits cyber criminals almost always use credentials as soon as they compromise them.
>Mandated password changes are a long-standing security practice, but current research strongly indicates that password expiration has a negative effect. Experiments have shown that users do not choose a new independent password; rather, they choose an update of the old one. There is evidence to suggest that users who are required to change their passwords frequently select weaker passwords to begin with and then change them in predictable ways that attackers can guess easily.
>One study at the University of North Carolina found that 17% of new passwords could be guessed given the old one in at most 5 tries, and almost 50% in a few seconds of un-throttled guessing. Furthermore, cyber criminals generally exploit stolen passwords immediately.
[1]https://www.microsoft.com/en-us/research/wp-content/uploads/...