# Ensure Identity Domain password policy prevents password reuse by remembering at least 24 previous passwords

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698515902980-ensure-identity-domain-password-policy-prevents-password-reuse-by-remembering-at-least-24-previous-passwords
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the identity domain password policy remembers at least the last 24 passwords for each user, so users cannot switch back to a password they used before. This makes sure that a password which may have been exposed in the past cannot simply be reused.

**Rationale**

Users often cycle between a small set of familiar passwords. If an old password was leaked or guessed, allowing it to be reused lets an attacker regain access with credentials they already have. Remembering at least 24 previous passwords makes this practically impossible and keeps the benefit of password changes.

**Impact**

-   Users cannot reuse any of their last 24 passwords
    
-   Old, possibly compromised passwords stay retired
    
-   Users must create new passwords when changing them
    

**Default Value**

By default, the identity domain password policy remembers only a small number of previous passwords.

**Pre-Requisites**

-   Identity domain administrator role
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.
    
4.  Check the Previous passwords remembered value.
    
5.  If it is less than 24, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.
    
4.  Select Edit password rules and choose Custom.
    
5.  Set Previous passwords remembered to 24 or more.
    
6.  Select Save changes.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.
    
4.  Select Edit password rules and choose Custom.
    
5.  Set Previous passwords remembered back to its previous value and select Save changes.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/passwordpolicies/modify-custom-password-policy.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/passwordpolicies/modify-custom-password-policy.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.