Background: I am working on a enterprise application where... 1. There can be 100 users in it and 1 admin for a single enterprise account. 2. Account admin can customise various settings in this particular application. 3. Our products is used very less by our final users. In an average our user login for 6 minutes on every weekday.
The story I am working on: As a user, I should be notify when the password policy is changed by my account admin. The system should notify me( as a user) that I need to change my password because my current password is not compliant to the new Password policy.
Also to note that this is an edge case. Not ever time an admin will change password policy. (Password policy is like number of minimum characters, uppercase lower case, numbers, special characters- this feature is their to cater various password policy for different organizations.
This is the kind of experience I wanted to give, where we do not force the user to change the password immediately. We give them a window of 7days to update password at a sweet time. :
But my PO does not want that, he wants to force users to change password immediately.
I am absolutely not convinced to interrupt user to change password immediately. But the PO thinks that it is a security issue and above that it is a company decision. Opinion Please.