For customers not using SSO, can you enforce password/passphrase complexity requirements (provided by the institution)?

This question is asking whether your system can enforce custom password complexity requirements specified by the institution (customer) for users who are not using Single Sign-On (SSO). Password complexity refers to rules that make passwords stronger and harder to guess, such as minimum length, requiring special characters, numbers, uppercase letters, etc. Why this matters in security assessments: 1. Strong passwords are a fundamental security control to prevent unauthorized access 2. Different organizations have different security policies and compliance requirements 3. The ability to customize password requirements allows institutions to align your service with their internal security policies SSO users typically authenticate through their institution's identity provider, so they follow the password rules of that system. This question specifically addresses non-SSO users who authenticate directly with your service. A good answer should clearly state whether your system: - Can enforce custom password complexity requirements - What specific parameters can be customized (length, character types, expiration, etc.) - How these customizations can be implemented (admin portal, API, support request, etc.) - Any limitations to customization capabilities