Azure AD SSO Password Rotation Not Enforced in my Active Directory Domain

Dear Community

Kindly note that we have a single domain and single tree. We have four sites and each site has its own domain controller. They are all getting synced. I have local active directory getting synced with Azure AD for office 365 accounts. Now we had VAPT done by a third party and they have said that the "Azure AD SSO Password Rotation is Not Enforced". I wanted to know What is the recommended standard practice? and If its recommended to change what will be its impact in my environment as explained previously?

I have selected tage as ADFS but I have active directory domain services.

Thanks.