We did 30 days, 15 days, one week, and 24 hours. And still, we'd have users get locked out for not changing their password or calling us in a panic because they only saw the 24hr notif. We switched over to only requiring changes when entra saw something fishy, which definitely lowered stress levels.