In mid-2018, Microsoft released a new feature called Azure AD Password Protection. It became generally available in April 2019. In July 2023, it was rebranded Microsoft Entra Password Protection. The goal of this feature is to allow on-premises Active Directory environments access to Microsoft’s global banned password list. Microsoft has developed and continues to add to a global banned password list based on known breaches and compromises. Along with a strong password policy, this feature adds an additional layer to password security by protecting users from utilizing weak or compromised passwords.
Requirements for utilizing Microsoft Entra Password Protection
Before implementing Microsoft Entra Password Protection for Active Directory, there are a few requirements that need to be met:
- A Microsoft Entra ID tenant
- Microsoft Entra ID P1 or P2 licensing for users
- Hybrid identity environment with Active Directory synchronized to Microsoft Entra ID
- Windows Server 2012 or newer domain controllers
- Microsoft Entra Password Protection Proxy service installed
- Microsoft Entra Password Protection DC Agent installed on domain controllers
How it works
Microsoft Entra Password Protection uses both Microsoft’s global banned password list and an optional custom banned password list created by your organization. When a user changes or resets their password in Active Directory, the password is evaluated against these lists.
If the password is considered weak, easily guessable, or contains banned terms such as company names, seasons, or common keyboard patterns, the password change is denied. This helps reduce the risk of password spray attacks and credential compromise.
One important feature is that Microsoft uses “fuzzy matching” and normalization. For example, passwords such as
- Summer2026!
- Password123
- CompanyName1
may still be blocked even if slight variations are used. This makes the protection significantly more effective than traditional password complexity requirements alone.
Deployment steps
1. Install the proxy service
The Microsoft Entra Password Protection Proxy Service communicates with Microsoft Entra ID and downloads the banned password policies. Preferably, this service should be installed on more than one member server in the environment for redundancy.
After installation:
- Register the proxy service with Microsoft Entra ID
- Register the Active Directory forest
2. Install the DC Agent
The DC Agent is installed on each domain controller. This agent intercepts password changes and validates them against the password protection policies. After installation, rebooting the domain controller is recommended.
3. Configure password protection policies
Policies are configured through the Microsoft Entra admin center. Administrators can configure:
- Password protection enablement or disablement for on-premises Active Directory
- Custom banned password lists
- Password lockout thresholds
- Lockout duration
- Audit mode or enforcement mode
Audit mode is highly recommended initially because it allows organizations to see what passwords would have been blocked without impacting users.
Best practices
To get the most value from Microsoft Entra Password Protection:
- Start in audit mode before enabling enforcement
- Add company-specific words and phrases to the custom banned list
- Continue enforcing strong password length requirements
- Encourage passphrases instead of short complex passwords
- Deploy multiple proxy servers for redundancy
- Monitor event logs for blocked password attempts and deployment issues
Benefits of Microsoft Entra Password Protection
Implementing Microsoft Entra Password Protection provides several security benefits:
- Reduces the use of weak and compromised passwords
- Helps defend against password spray attacks
- Extends cloud-based password intelligence to on-premises Active Directory
Need assistance with Microsoft Entra Password Protection?
If you have any questions about Microsoft Entra Password Protection or would like to discuss how to optimize it for your organization, please reach out to our experts at any time.
This publication contains general information only and Sikich is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or any other professional advice or services. This publication is not a substitute for such professional advice or services, nor should you use it as a basis for any decision, action or omission that may affect you or your business. Before making any decision, taking any action or omitting an action that may affect you or your business, you should consult a qualified professional advisor. In addition, this publication may contain certain content generated by an artificial intelligence (AI) language model. You acknowledge that Sikich shall not be responsible for any loss sustained by you or any person who relies on this publication.
