We took a different approach at my last job when we revisited our entire identity management approach. We were a University with Federated logins across a few dozen system, and our password rules had honestly spiraled out of control because the system hadn't been constructed in such a way to restrict access easily.

During the rework, we focused on a few things primarily:

1. Reduce password complexity, enforce legnth 2. Restructure account creation around least-privilege principal, so that access had to be granted, not just created during account creation, and also allow fast and easy addition and removal of access to system as part of the Management System 3. Revisit password expiries based on level of access and relative strength of password (as determined by zxcvbn)

Students and low level staff loved it - if you had a standard account and didn't have any access to anything sensitive that didn't belong to you, your password could sit untouched for up to 2 years I think if it met the strength requirements.

Those with access to actual sensitive data (student records, finances, etc), were held to a higher class of password complexity and would suffer a rotation penalty if they didn't have a sufficiently complex password; this mostly did away with the number of people with very common passwords, though it didn't go without a lot of fighting for some of the administrators, which, as I remember the discussions anyways, were more pride issues than anything. We used that as an opportunity to roll out password managers