Agent Foskett Academy • Microsoft Entra • Module 2 • Lesson 18

Lesson 18 — Microsoft Entra Password Protection

Strong password rules are not enough when users still choose predictable words, company names, seasons, sports teams or simple variations of passwords exposed in attacks.

Microsoft Entra Password Protection evaluates password changes against Microsoft’s global banned-password intelligence and an organisation’s own custom banned-password list. In hybrid environments, the same protection can be extended to on-premises Active Directory domain controllers.

This lesson explains how password scoring works, how global and custom banned-password lists are applied, how audit and enforcement modes operate, and how Agent Foskett investigates weak-password failures across cloud and hybrid identity environments.

A password can satisfy length rules and still be dangerously predictable.

Start Lesson Back to Microsoft Entra Academy

Agent Foskett Microsoft Entra Password Protection lesson

What you will learn

This lesson explains how Microsoft Entra prevents weak passwords in cloud and hybrid identity environments.

Global banned passwords

Custom banned lists

Hybrid deployment

Audit and enforcement

Learning objectives

After completing this lesson, you should be able to explain, configure and investigate Microsoft Entra Password Protection.

Explain why traditional password complexity rules are not enough.
Describe the global banned-password list.
Configure a custom banned-password list.
Explain password normalisation and scoring.
Describe audit and enforced modes.
Understand the hybrid proxy and domain controller agent architecture.
Investigate rejected password changes and deployment health.

The problem this solves

Users frequently create passwords that technically satisfy length and complexity requirements but remain easy to guess.

Predictable patterns such as company names, seasons, years, sports teams and keyboard sequences are repeatedly targeted during password spraying and credential attacks.

What is Microsoft Entra Password Protection?

Microsoft Entra Password Protection evaluates password changes and resets against Microsoft’s global banned-password intelligence and optional organisation-specific terms.

User creates or resets a password ↓ Password is normalised ↓ Microsoft Entra evaluates banned terms and variants ↓ Password receives a score ↓ Score meets the minimum threshold ↓ Password is accepted OR Password is rejected as too predictable

Global banned-password list

Microsoft maintains a dynamic global list of weak, common and frequently attacked passwords.

The full list is not published because it is continuously updated from Microsoft security intelligence and password-attack telemetry.

Custom banned-password list

Organisations can add terms that are especially predictable in their own environment.

Examples include company names, product names, local locations, internal project names, mascots and common abbreviations.

Why complexity alone is not enough

Password example	Traditional complexity	Real security value
Summer2026!	Uppercase, lowercase, numbers and symbol.	Highly predictable and commonly attacked.
CompanyName1!	May satisfy policy.	Easy to guess from public information.
Password123!	May satisfy legacy rules.	Widely known and repeatedly used in attacks.
Long unique passphrase	May appear simpler.	Often stronger because it is longer and less predictable.

Password normalisation

Before evaluation, Microsoft Entra normalises a password so common substitutions and formatting changes do not easily bypass protection.

For example, uppercase and lowercase differences or character substitutions such as “@” for “a” may still be recognised as variants of a banned term.

Password scoring

Each portion of the password contributes to a score based on whether it matches banned terms or acceptable unique content.

The password is accepted only when the total score meets the required threshold.

How password evaluation works

Proposed password ↓ Convert to standard form ↓ Identify banned words and variants ↓ Identify remaining unique characters ↓ Calculate the password score ↓ Compare with the acceptance threshold ↓ Accept or reject the password

Custom-list design

Add organisation-specific words attackers could easily guess.
Include common abbreviations and brand variations.
Avoid adding every dictionary word.
Review the list after mergers, rebrands or major projects.
Remove obsolete terms only after considering historical exposure.

What not to add

Long lists of random weak passwords already covered globally.
Every employee name.
Every city or country.
Generic dictionary content.
Terms added without understanding user impact.

Cloud protection

Microsoft Entra Password Protection is automatically applied to password changes and resets for cloud-only users.

Custom banned-password policies extend this protection with organisation-specific terms.

Hybrid protection

For on-premises Active Directory, organisations deploy Microsoft Entra Password Protection proxy services and domain controller agents.

This extends cloud intelligence to password changes performed against Active Directory domain controllers.

Hybrid architecture

Microsoft Entra Password Protection policy ↓ Password Protection Proxy Service ↓ Policy downloaded and cached securely ↓ Domain Controller Agent ↓ User or administrator changes a password ↓ Password evaluated locally on the domain controller ↓ Audit or enforced decision recorded

Password Protection proxy

The proxy service communicates with Microsoft Entra, retrieves policy updates and makes them available to domain controllers.

It does not receive or transmit user passwords for cloud inspection.

Domain controller agent

The domain controller agent evaluates password changes locally using the cached password policy.

Each writable domain controller that processes password changes should be protected.

Audit mode

Audit mode records when a password would have been rejected but does not block the password change.

This is useful for measuring impact and finding weak-password patterns before enforcement.

Enforced mode

Enforced mode rejects passwords that fail Password Protection evaluation.

Move to enforcement only after audit data, support processes and domain-controller coverage have been reviewed.

Recommended hybrid rollout

1. Review Active Directory topology ↓ 2. Identify writable domain controllers ↓ 3. Install and register proxy services ↓ 4. Deploy domain controller agents ↓ 5. Enable audit mode ↓ 6. Review event logs and user impact ↓ 7. Improve the custom banned-password list ↓ 8. Confirm all domain controllers are covered ↓ 9. Move to enforced mode ↓ 10. Monitor policy and agent health

High availability

Deploy more than one proxy service so domain controllers can retrieve policy updates if one proxy is unavailable.

Domain controller agents continue using their cached policy if temporary connectivity is lost.

Policy caching

Policy data is cached locally so password evaluation can continue without a live cloud connection.

This supports resilient on-premises password changes while preserving central policy updates.

Administrative resets

Password Protection can evaluate passwords set by users and administrators.

Helpdesk staff should never bypass weak-password controls by choosing predictable temporary passwords.

Integration with SSPR

When SSPR changes a password, the new value must pass the relevant cloud and, for hybrid users, on-premises password policy.

Password Protection therefore strengthens both routine password changes and recovery activity.

Evidence and monitoring

Evidence source	What it shows	Investigation value
Microsoft Entra audit logs	Password changes, resets and policy administration.	Connects user activity with configuration changes.
Domain controller event logs	Accepted, audited or rejected password operations.	Identifies weak-password attempts and enforcement outcomes.
Proxy operational logs	Policy retrieval, registration and communication status.	Confirms whether hybrid policy distribution is healthy.
Agent health	Coverage across domain controllers.	Finds unprotected password-change paths.
Helpdesk reports	User-facing failure patterns.	Highlights confusing policies or common banned terms.

Agent Foskett investigation: “The password meets complexity, but it is still rejected”

1. Confirm where the password change occurred ↓ 2. Identify whether the account is cloud-only or hybrid ↓ 3. Confirm the exact rejection message ↓ 4. Review banned-password and custom-list policy ↓ 5. Check whether the password contains predictable terms ↓ 6. Review Microsoft Entra or domain controller logs ↓ 7. Confirm whether audit or enforced mode is active ↓ 8. Validate agent and proxy health for hybrid users ↓ 9. Test with a strong unique passphrase ↓ 10. Correct policy or deployment issues without weakening protection

Signs of incomplete deployment

Some domain controllers reject weak passwords while others accept them.
Proxy registration is missing or unhealthy.
Domain controller agents are absent from newer servers.
Audit events appear from only part of the environment.
Policy updates are stale.
Helpdesk resets behave differently from user resets.

Immediate actions

Identify all writable domain controllers.
Confirm agent coverage.
Verify proxy registration and availability.
Review audit and operational logs.
Test password changes against multiple domain controllers.
Document the final enforcement state.

Real-world scenario: one domain controller still accepted the company name

1. The organisation enables a custom banned-password list ↓ 2. Most users cannot set CompanyName2026! ↓ 3. One remote-site user successfully sets it ↓ 4. Agent Foskett identifies the authenticating domain controller ↓ 5. The domain controller agent is missing ↓ 6. The server is added to the deployment plan ↓ 7. The Password Protection agent is installed ↓ 8. Audit events confirm policy evaluation ↓ 9. Enforcement testing blocks the password consistently

Common mistakes

Mistake	Impact	Better practice
Relying only on complexity rules	Predictable passwords remain acceptable.	Use Password Protection and strong authentication methods.
Adding an excessive custom list	Management becomes difficult and user impact increases.	Focus on organisation-specific predictable terms.
Skipping audit mode	Enforcement surprises users and support teams.	Measure impact before blocking.
Missing domain controllers	Weak passwords can still be set through unprotected paths.	Protect every writable domain controller.
Deploying a single proxy	Policy updates depend on one service.	Use multiple registered proxy servers.
Using weak temporary passwords	Administrative resets undermine the policy.	Use strong temporary credentials and secure recovery methods.

Key takeaways

Traditional password complexity does not prevent predictable passwords.
Microsoft’s global banned-password intelligence blocks common and attacked password patterns.
Custom banned-password lists protect organisation-specific names and terms.
Password normalisation detects simple substitutions and variants.
Audit mode should be used before enforcement in hybrid environments.
Hybrid protection requires proxy services and domain controller agents.
Every writable domain controller must be included to avoid inconsistent enforcement.
Password Protection strengthens password changes, administrative resets and SSPR.

Related Agent Foskett resources

Continue developing Microsoft Entra password, authentication and identity security skills.

Lesson 17 — Self-Service Password Reset Lesson 16 — Authentication Strengths Lesson 15 — Authentication Methods Policies Lesson 4 — MFA and Authentication Methods Lesson 3 — Conditional Access Fundamentals Microsoft Identity and Access Services

Continue learning

Continue through Microsoft Entra identity security, or return to the academy roadmap.

⬅ Previous lesson

Lesson 17 — Self-Service Password Reset in Microsoft EntraUnderstand secure password recovery, verification methods and hybrid password writeback.

🏠 Academy home

Microsoft Entra AcademyReview the roadmap and continue through the identity security learning path.

📘 Next lesson

Lesson 19 — Smart Lockout in Microsoft EntraLearn how Microsoft Entra detects password attacks while reducing accidental user lockouts.

Microsoft Entra Password Protection and Banned Password Lists

Microsoft Entra Password Protection blocks weak and predictable passwords through Microsoft’s global banned-password intelligence, custom banned-password lists, password normalisation and scoring.

Microsoft Entra Academy Lesson 18 — Password Protection

This Agent Foskett lesson explains cloud password protection, hybrid Active Directory proxy and domain controller agents, audit and enforced modes, custom banned-password design, deployment health and weak-password investigations.