Nice, I always found forced password changes (except in case of breach) extremely annoying, hadn't ever looked for a resource that justifies my annoyance. http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf#page=23

Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

Lots of other recommendations that are often annoyingly not followed in nearby text.

That publication doesn't really provide any justification other than by reputation, but turns out that's easy to find as well, eg:

• https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes
• https://www.ncsc.gov.uk/articles/problems-forcing-regular-password-expiry
• https://www.schneier.com/blog/archives/2016/08/frequent_passwo.html

I think these probably all refer to the same research showing something like choosing/changing a password is costly, so if you have to do it often you'll do it worse.