Password policy

Set a strong baseline and avoid relying on complexity rules alone.

Authentication policy

Suggested prototype defaults; actual enforcement must be implemented by the identity provider.

Demo only: saved in this browser, not enforced by a backend.

Production note: enforce throttling, breached-password screening, secure reset flows, and MFA on the server / identity provider. UI settings alone do not protect accounts.