@HeartInternet Forcing a password change, even if once yearly, screws with that, for little perceived benefit. Honestly, if you want to protect accounts, you'd do better to implement 2FA on your portal (or maybe you have and I missed the announcement, it's not like I log in frequently).