IA.2.084 — Allow temporary password use with immediate change requirement

What IA.2.084 means in plain English

When IT creates a new account or resets a forgotten password, they give the employee a temporary password. The system must force the employee to change that temporary password the very first time they log in — the employee should never be allowed to keep using the temporary password day-to-day. This is a standard feature in Windows and Microsoft 365: when you create an account, you check the box "User must change password at next logon." For your team, make this part of every new account setup and every password reset procedure.

The assessment question

“Is the "user must change password at next logon" flag set whenever a temporary or reset password is issued — and is it technically enforced so the user cannot bypass it?”

How to implement IA.2.084

1. For every new Windows account creation or password reset, check the "User must change password at next logon" option in Active Directory Users and Computers or Azure AD.
2. In Microsoft 365, when resetting a user's password, always leave the "Require this user to change their password when they first sign in" toggle enabled.
3. Document this requirement as a mandatory step in your New Employee Onboarding and Password Reset procedures.
4. Verify the enforcement by logging in with a reset account and confirming the password change prompt appears before any other action is possible.
5. Train the helpdesk person (even if that is you, the owner) to never skip this step when creating or resetting accounts.

Evidence your assessor will ask for

• Screenshot of the new user creation screen showing "must change password at next logon" selected
• Password Reset Procedure document specifying mandatory temporary password with forced change
• Test log showing a newly reset account prompted for password change on first login

More Identification & Authentication controls