Length over complexity: long passphrases are easier to remember and harder to crack than short, cryptic passwords.
Unique per service: reuse is the biggest risk in data leaks.
No scheduled forced change, but change on suspected compromise. This is what BSI and NIST recommend.
Block known weak passwords: reject lists from breaches and trivial passwords.
Add MFA so a stolen password is not enough.
Allow and promote password managers.
A practical policy
A minimum length of twelve or more characters for user accounts, considerably longer for administrator accounts, lockout after repeated failures, no sharing, storage in a password manager. For service accounts use long random passwords or managed accounts.
Implementation
In Active Directory, rules can be implemented through password policies and fine-grained password policies, in Entra ID through password protection. What matters is support: explain to employees why the rules apply and provide a password manager.