We are in a mid-sized enterprise environment and are looking at forcing specific passwords for all users. I've found nothing recent or relevant about this.
The main reason is to ensure that personal passwords (often compromised) are not used in our environment. Go ahead and use your LinkedIn password for your bank account, just keep it out of my environment.
IT is familiar with generating long, full charset, but still highly memorable passphrases. Whereas a user facing a 14 character minimum might immediately forget what they just entered. correct horse battery staple, baby!
Entropy. What's better than generating your own passphrase? Having a password nerd admin who knows what "random" actually means do it for you.
The company culture supports it. Users are coddled. Help Desk staff keeps an encrypted list of passwords because users assume we can log in as them on a whim. In our case, the risk of someone in IT setting the world on fire doesn't lessen by setting passwords. That risk is inherited by the trust bestowed upon us by users. They want (ugh, need) IT to have their password.
Microsoft has just changed their tune about password expiration policies, placing more weight on length and charset. More of a selling point to the change. "Ok you don't have to change your password as often, but in exchange, we're going to set a secure one for you"
All accounts still sit behind MFA, maximum login attempt policies, etc. No reason to stop using common sense now.
This all reeks of a "we know better than you" mentality but other than that, what are the pros and cons?