Bypassing Password Verify Function I am considering making a recommendation to enforce a password verify function that will not allow users to change their own passwords.  My understanding of the PASSWORD_VERIFY_FUNCTION in Oracle is that the function only restricts the password criteria when the user changes his or her own password.  It would not restrict a privileged user from changing someone else's password or a third party IAM software from changing the password, but I cannot find that expressly documented.  Am I correct?
The PASSWORD_VERIFY_FUNCTION is used, even when a privileged user changes another user's password, see below.

SQL&gt; @?/rdbms/admin/utlpwdmg.sql
SQL&gt; create user u1 identified by Oracle123#;

User created.

SQL&gt; select profile from dba_users where username = 'U1';

PROFILE
------------------------------
DEFAULT

SQL&gt; select limit from dba_profiles where profile = 'DEFAULT' and resource_name = 'PASSWORD_VERIFY_FUNCTION';

LIMIT
----------------------------------------
VERIFY_FUNCTION_11G

SQL&gt; show user
USER is "SYS"

SQL&gt; alter user u1 identified by 1;
alter user u1 identified by 1
*
ERROR at line 1:
ORA-28003: password verification for the specified password failed
ORA-20001: Password length less than 8