You should always limit the password length to whatever size at which the underlying storage or scrambling mechanism stops working or loses entropy. Likely, Microsoft uses a shitty hash function to scramble passwords.
The common gospel around here is to say "Use bcrypt.", but very few people say (or know?) that its maximum input length is 55 bytes, i.e. 55 ASCII characters, or far fewer unicode characters. Most implementations actually cut off the remainder, which is a very dangerous thing to do since you might have people who use a relatively simple passphrase followed by a strong password which happens to be beyond the maximum length, and is lost.
For most other hash algorithms, if you use a hash function with an output size of 256 bits, you will lose entropy if the input contains more than 256 bits of entropy. It is a little hard to measure what the maximum length should be for e.g. passwords, but the length should almost never be unlimited. It conveys a false, and in some cases, e.g. with bcrypt, quite dangerous sense of security.
Comments
You should always limit the password length to whatever size at which the underlying storage or scrambling mechanism stops working or loses entropy. Likely, Microsoft uses a shitty hash function to scramble passwords.
The common gospel around here is to say "Use bcrypt.", but very few people say (or know?) that its maximum input length is 55 bytes, i.e. 55 ASCII characters, or far fewer unicode characters. Most implementations actually cut off the remainder, which is a very dangerous thing to do since you might have people who use a relatively simple passphrase followed by a strong password which happens to be beyond the maximum length, and is lost.
For most other hash algorithms, if you use a hash function with an output size of 256 bits, you will lose entropy if the input contains more than 256 bits of entropy. It is a little hard to measure what the maximum length should be for e.g. passwords, but the length should almost never be unlimited. It conveys a false, and in some cases, e.g. with bcrypt, quite dangerous sense of security.