Force password update

Corentin Dal Farra

Hello everyone,

Do you know if there a way to set a password change policy? 

For example, I want people to change their passwords after 3 months. Can I set that to happen automatically?

Thank you for your help !

Corentin

Genevieve P.

Hi @Corentin Dal Farra

If you are a System Admin on your organization's plan you can manually send individual password-reset emails to each user, however there isn't a way to automatically bulk-send these emails.

In the User Management section of the Admin Center, click on the three dots to the far right of a specific user. Then click "Send Password Reset Email" from the drop-down:

See: Admin Center: Add, Edit, and Delete Individual Users with User Management

I hope this helps!

Cheers,

Genevieve

Corentin Dal Farra

Hi @Genevieve P

Thank you for your answer,

I have tested your solution, but it seems that when I ask Smartsheet to send a password email reset to a user, he is not forced to change his password.

I was wondering if we can send an email and put a mandatory password reset, otherwise the user cannot login anymore ?

Have a great day,

Corentin

Genevieve P.

Hi @Corentin Dal Farra

Thank you for clarifying! No, there isn't a way to lock a user out of their account until they re-set their password through Smartsheet's Admin Center.

If you're on an Enterprise plan, you may want to look into the different ways of managing Authentication Options (see here), including potentially setting up a sign-in using company credentials and SSO (Single Sign On).

Thanks, I hope you have a great day and weekend as well.

Cheers!

Genevieve

Stefan

Hi @Corentin Dal Farra and @Genevieve P,

as Genevieve pointed out, there is no automated solution for you request.

And I think there is good reason not to have it ;-) I hope you don't mind if I question the habit of requiring password resets regularly.

I see only one scenario where I would like to force change the password of an user:

- You think the password of an account is compromised -> Request the user to change his/her password either the way Genevieve described, or ask him/her to do it in the account settings.

@Genevieve P it would be helpful in this case to be able as an admin to force setting of a new password. Maybe input for the team in charge of the admin center?

Regularly requesting password changes is an outdated habit and not helping security but actually damaging security. I'd recommend to rethink this habit :-)

There are many good articles about this topic, here is a short selection:

Microsoft in 2019: Dropping the password expiration policies.**

https://docs.microsoft.com/de-de/archive/blogs/secguide/security-baseline-final-for-windows-10-v1903-and-windows-server-v1903

FTC from 2016

https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes

Hope this helps

Stefan

Genevieve P.

Thank you for your input, @Stefan!

Corentin Dal Farra

Hello @Genevieve P and @Stefan

Thank you both for this clarification.

Have a great day,

Corentin