# Set up Periodic Password Changes for an Extension

A password that never changes gives an attacker a stable target. As an administrator, you can require the user of an extension to rotate their password on a recurring schedule, keeping credentials fresh and reducing the risk of a compromised account.

## Before you begin

Your Cloud Voice system must be running server version `84.18.0.102` or later.

## Force periodic password changes

:::note
This rule applies only to the extension you open in these steps. Extensions you do not edit keep their current sign-in settings, so apply the same steps to each extension that needs the policy.
:::

1. Log in to the Cloud Voice Dashboard at https://voice.izt.cloud and click **Login** to open your phone system's management portal with full administrator access, then go to **Extension and Trunk > Extension**.
2. Find the extension you want to update and click the edit icon ![Edit an extension](/images/pbx/edit.png) next to it.
3. Open the **Security** tab and scroll to the **Login Security** section, then set the following:
   1. Turn on **User must change password periodically**.
   2. In **Password Change Frequency (Day)**, enter how long a password stays valid, in days. Any value from 1 to 365 is accepted; the default of 30 requires a new password every 30 days.
4. Click **Save**.

## What the user sees

Once the setting is active, the extension user is warned **3 days** and again **1 day** before their password expires.

:::caution
If the user does not set a new password before the current one expires, they are locked out and cannot sign in until they choose a replacement. Remind users ahead of the deadline so a missed change does not interrupt their service.
:::

Reminders reach the user in two ways:

- If the extension has a notification email address on file, Cloud Voice emails a **Password expiration reminder**.
- The next time the user opens the Cloud Voice App, a dialog tells them the password is expiring and needs to be updated.

![Prompt asking the user to update an expiring password](/images/pbx/update-password.png)

:::note
Expiration reminders only appear in current Cloud Voice App builds. Ask affected users to update to at least these versions:

- Desktop app: 1.11.7 or later
- Mobile app (iOS): 5.13.6 or later
- Mobile app (Android): 5.13.8 or later
:::