I was working through evidence requests with one of my tenants, and four of them asked about passwords, but used the term “password configuration” in the request. We’re a little confused about what is meant by the term “configuration”. Does it mean password complexity requirements in the policy documents, or does it mean evidence of configuration of said requirements in systems (for example, a Group Policy in AD). Or does it mean both working together?