Microsoft and NIST agree special characters shouldn't be required, and to not force password resets/changes, with an 8 character minimum