Why not let the administrator decide?

Why not let the administrator decide?

My company mandates a minimum length of 16 characters, which in me at least inspires some creative (and easy to remember) passwords.

I agree there are some ways of making longer passwords that are still easy to remember. For example, my work password expresses just what I think of my employer's password policy, which makes it easier to remember when it's time to type it. The problem is with the "in me at least" part, because you have to get everyone on board for it to work. Getting into a system is a weakest link type of thing, so it only takes a few people who pick easy passwords to undo the benefits of whatever clever password policy you choose. Meanwhile, 2FA gives you better security than most of the passwords real users are likely to pick and resistance to other kinds of attacks, like phishing. Oh, and users can't easily bypass the need for 2FA the same way they can undermine strong password policies.