It seems that Sitecore 9.1, with the new Identity Server, no longer uses the same way of configuring password complexity as the previous versions.

Some of the links that I found related to 9.0 and earlier versions

I can't seem to find how to configure the password complexity for 9.1.

In particular, I am looking at configuring

  • minRequiredNonalphanumericCharacters: 2
  • minRequiredPasswordLength: 16

Can you please help me?

1 Answer 1


After my investigation, it appears that the default configuration of Identity Server is federating the authentication back to the Sitecore Membership of the main Sitecore instance.

The default configuration is found in $path_to_your_Sitecore_identity_instance$\Config\production\Sitecore.IdentityServer.Host.xml

<?xml version="1.0" encoding="utf-8" ?>
        <ConnectionString>Data Source=xxxx;Initial Catalog=xxxx_Core;User ID=xxxx;Password=xxxx</ConnectionString>

More details of the Sitecore Identity structure can be found here

Since the identity server is federating back to the main Sitecore instance's membership, the same old method of editing the membership section in the web.config to add password complexity still works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.