> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/cipp/settings/password-config.md). # Password Configuration This page controls how CIPP generates passwords, covering new users, password resets, JIT admin accounts and anywhere else CIPP produces a credential. The setting applies across the whole instance rather than per tenant or per technician. Choose a type using the toggle at the top of the card, configure the settings that appear for it, then select **Save**. Settings for the type you are not using are retained, so switching back and forth does not lose them. ## Password Type | Type | Description | | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Classic | Random characters drawn from the character classes you enable. Suited to systems that insist on specific character types. Sixteen characters or more is recommended for strong security. | | Passphrase | Random dictionary words joined by a separator. Easier to read out and retype, and typically stronger than a classic password of the same length. Five words or more is recommended for high security. | ## Classic Settings | Setting | Description | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Length | How many characters the password contains. Must be between 8 and 256. The default is 14. | | Uppercase (A-Z) | Includes uppercase letters. | | Lowercase (a-z) | Includes lowercase letters. | | Digits (0-9) | Includes numbers. | | Special Characters | Includes symbols, drawn from the set below. | | Special Characters (text field) | The symbols available to the generator, shown when the switch above is on. The default is `$%&*#`. Only `!@#$%^&*()-_=+/` are accepted, up to 32 characters. | ## Passphrase Settings | Setting | Description | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- | | Words | How many words the passphrase contains. Must be between 3 and 10. The default is 4. | | Separator | The character placed between words. The default is a hyphen. Can be left empty, and accepts up to five characters from `!@#$%^&*()-_=+/`. | | Capitalize words | Capitalises the first letter of each word, which supplies the uppercase character type. | | Append number | Adds a number to the end of the passphrase, which supplies the digit character type. | | Append Special Character | Adds a symbol to the end of the passphrase, which supplies the special character type. | | Special Characters | The symbols available for the appended character, shown when **Append Special Character** is on. Same restrictions as for classic passwords. | ## Complexity Requirements Microsoft 365 requires a password to contain at least three of the four character types: uppercase letters, lowercase letters, numbers and symbols. CIPP enforces this when you save, so a configuration that cannot meet it is rejected with an explanation rather than silently producing passwords Microsoft will refuse. For classic passwords this means at least three of the four character class switches must be on. For passphrases, the words themselves supply lowercase, so at least two of the following must also apply: | Requirement | Supplied by | | ----------- | ------------------------------------------------------------ | | Uppercase | Capitalize words | | Numbers | Append number, or a separator containing a digit | | Symbols | Append Special Character, or a separator containing a symbol | {% hint style="info" %} The separator counts towards complexity. A passphrase using the default hyphen separator already supplies the symbol type, so enabling **Capitalize words** alone is enough to satisfy the requirement. {% endhint %} {% hint style="warning" %} Avoid setting the separator to a single space. Although the configuration will save, password generation rejects a whitespace-only separator, so credential creation will fail afterwards. {% endhint %} *** ## Feature Requests / Ideas We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cipp.app/user-documentation/cipp/settings/password-config.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.