# Excluding specific users from password policies

**URL:** <https://forum.keycloak.org/t/excluding-specific-users-from-password-policies/14864>\
**Category:** Getting advice\
**Tags:** admin-console, authentication\
**Created:** [April 8, 2022, 1:11pm UTC](https://forum.keycloak.org/t/excluding-specific-users-from-password-policies/14864 "2022-04-08T13:11:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![egghead](https://avatars.discourse-cdn.com/v4/letter/e/5daacb/32.png) [@egghead](https://forum.keycloak.org/u/egghead)\
**Post date:** [April 8, 2022, 1:11pm UTC](https://forum.keycloak.org/t/excluding-specific-users-from-password-policies/14864/1 "2022-04-08T13:11:11Z")

</div>

**Basic Scenario in Keycloak:**

- I have a realm (connected to my application)
- a specific user (with roles for my application; e.g. I use the username to send REST requests to the REST API of my application)
- and a password policy (e.g. “Expire Password”)

**Use Case:**  
By default, password policies apply to all users. Now, however, I want to exclude this specific user from the password policies.

**Question:**  
Can I exclude this user from the password policies with out-of-the-box functions in the graphical user interface of the Keycloak Admin Console?

~

**Possible solution attempts:**

- There are no default “roles” (e.g. in Admin Console \> “Users” \> _select user_ \> “Role Mapping” \> “real-management” \> …) to exclude the user from password policies.
- “Service accounts” (for clients, not users) are excluded from the password policies, can I simply use a service account to send REST requests to the REST API of my application as described here? (not a out-of-the-box solution, though, since I also need to send REST requests to Keycloak to get info about the service account) [keycloak-documentation/service-accounts.adoc at main · keycloak/keycloak-documentation · GitHub](https://github.com/keycloak/keycloak-documentation/blob/main/server_admin/topics/clients/oidc/service-accounts.adoc)
- Apparently, I can also set up the “master” realm to do this, but this is also not out-of-the-box (since you have to use code to fetch the users from the specific realm): [java client - Exclude a user with realm-management role from keycloak's password policy - Stack Overflow](https://stackoverflow.com/questions/55145489/exclude-a-user-with-realm-management-role-from-keycloaks-password-policy)