{"id":138,"date":"2023-03-27T10:51:47","date_gmt":"2023-03-27T09:51:47","guid":{"rendered":"http:\/\/virtualnomad.nl\/?p=138"},"modified":"2023-04-03T15:05:35","modified_gmt":"2023-04-03T14:05:35","slug":"enhance-password-security-with-azure-ad-password-protection","status":"publish","type":"post","link":"https:\/\/virtualnomad.nl\/?p=138","title":{"rendered":"Enhance Password Security with Azure AD Password Protection"},"content":{"rendered":"\n

Azure Active Directory (AD) Password Protection is an integral feature of Azure AD that safeguards users from selecting weak, easily guessable, or compromised passwords. Microsoft maintains a “global banned passwords” list that comprises passwords deemed too common. While this list remains unpublished, you can utilize Azure AD Password Protection to validate password changes against it for both cloud and on-premises users.<\/p>\n\n\n\n

Additionally, you can create a custom banned password list with up to 1,000 entries to include organization-specific information which could be easily guessed.<\/p>\n\n\n\n

When processing a password change, the service normalizes the password (i.e., converting it to lowercase and replacing common substitutions like W3lC0m301 -> welcome01) and compares the result against the banned password lists. If there’s a match, the user receives an error message and is prompted to choose a more secure password.<\/p>\n\n\n\n

One drawback of the current implementation is its all-or-nothing approach. It would be beneficial if organizations could implement different password policies for different user groups. Hopefully, future updates will address this limitation.<\/p>\n\n\n\n

Before diving into the setup process, let’s briefly discuss licensing! License requirements vary depending on whether you are protecting cloud or AD-synced users and if you want to use the custom banned password list.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Azure AD Password Protection is automatically enabled for cloud users using the global password list, and it cannot be disabled. However, you can configure lockout thresholds and establish the custom password list by navigating to Azure Portal > Azure AD > Security > Authentication methods > Password protection blade or in the new Microsoft Entra Admin Center > Azure AD > Protect & Secure > Authentication Methods > Password protection.<\/p>\n\n\n\n

The custom password list permits up to 1,000 entries, with each item having a minimum of 4 and a maximum of 16 characters. Given the system’s password normalization process, it’s advisable to include only keywords, such as “Welcome” or “Monday,” instead of variations like “M0Nd@y!”<\/p>\n\n\n\n

Under Azure AD Password Protection settings, you will find an option for Mode, which can be set to “Enforced” or “Audit.” Note that this setting applies only to Windows Server Active Directory, and it does not affect the cloud user password protection status (i.e., it cannot be toggled on or off).<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

To protect on-premises users who authenticate via a traditional Windows Server Active Directory account (and those users whose accounts are synced using Azure AD Connect), you need to install a proxy service on a member server and an agent and password filter DLLs on the domain controllers. The proxy service enables your domain controllers to access the Azure AD Password Policy service.<\/p>\n\n\n\n

You can find the required installers at the download center<\/a>. There are two installers: the Proxy Setup (EXE) and the DC Agent (MSI). Install the Proxy service on a member server and the DC agent on your domain controllers. Note that updating the password filter DLLs will necessitate a reboot of the domain controllers. Additionally, you will need domain admin rights to the forest root domain, as the forest is registered with Azure AD Password Protection rather than individual domains.<\/p>\n\n\n\n

After installation, you must register the proxy and the forest with Azure AD. The process installs a PowerShell module, so open PowerShell and execute the following commands:<\/p>\n\n\n\n

Register-AzureADPasswordProtectionProxy -AccountUpn yourglobaladmin@yourtenant.onmicrosoft.com’<\/strong><\/p>\n\n\n\n

Register-AzureADPasswordProtectionForest -AccountUpn ‘yourglobaladmin@yourtenant.onmicrosoft.com’<\/strong><\/p>\n\n\n\n

The -AuthenticateUsingDeviceCode<\/code> switch is optional, but if omitted, you must either disable Internet Explorer Enhanced Security mode or have a compatible browser installed on the server for the login prompt to function. Utilizing this switch provides a code to enter into a browser on your desktop machine. If you’re installing on Server Core, this switch is necessary since there’s no browser available to display the login prompt.<\/p>\n\n\n\n

Once the proxy and forest are registered, there’s no further configuration needed on the domain controllers. To enable the feature, go to Azure Portal > Azure AD > Security > Authentication methods > Password protection blade or in the new Microsoft Entra Admin Center > Azure AD > Protect & Secure > Authentication Methods > Password protection.<\/p>\n\n\n\n

In Audit mode, password changes proceed as usual, but the event log on domain controllers will record whether the password would have been rejected. You can find the log under Applications and Services Logs > Microsoft > AzureAD > PasswordProtection > DCAgent > Admin.<\/p>\n\n\n

\n
\"\"
Here you can see that audit mode is used.<\/em><\/figcaption><\/figure>\n<\/div>\n\n\n

Audit mode is valuable for assessing the volume of weak passwords in use before informing users about stricter password policies. It won’t reveal attempted passwords but can help identify which users are the biggest offenders.<\/p>\n\n\n\n

A comprehensive list of event log entries associated with Azure AD Password Protection is available in the Microsoft Docs<\/a>.<\/p>\n\n\n\n

When the policy is set to Enforce, attempting to set a password that doesn’t comply with Azure AD Password Protection will yield a generic “Password does not meet the password policy requirements” error.<\/p>\n\n\n

\n
\"\"
The error shown when you change an AD account password to something not permitted by the policy<\/em><\/figcaption><\/figure>\n<\/div>","protected":false},"excerpt":{"rendered":"

Azure Active Directory (AD) Password Protection is an integral feature of Azure AD that safeguards users from selecting weak, easily guessable, or compromised passwords. Microsoft maintains a “global banned passwords” list that comprises passwords deemed too common. While this list remains unpublished, you can utilize Azure AD Password Protection to validate password changes against it…<\/p>\n","protected":false},"author":1,"featured_media":144,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4],"tags":[7,9],"class_list":["post-138","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-office-365","tag-o365","tag-security"],"yoast_head":"\nEnhance Password Security with Azure AD Password Protection - Virtual Nomad<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/virtualnomad.nl\/?p=138\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Enhance Password Security with Azure AD Password Protection - Virtual Nomad\" \/>\n<meta property=\"og:description\" content=\"Azure Active Directory (AD) Password Protection is an integral feature of Azure AD that safeguards users from selecting weak, easily guessable, or compromised passwords. Microsoft maintains a “global banned passwords” list that comprises passwords deemed too common. While this list remains unpublished, you can utilize Azure AD Password Protection to validate password changes against it...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/virtualnomad.nl\/?p=138\" \/>\n<meta property=\"og:site_name\" content=\"Virtual Nomad\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-27T09:51:47+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-04-03T14:05:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/password-security.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"728\" \/>\n\t<meta property=\"og:image:height\" content=\"380\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Arno Geboers\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Arno Geboers\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138\"},\"author\":{\"name\":\"Arno Geboers\",\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/#\\\/schema\\\/person\\\/3c08ee70c43dfd351fe038a7f6038d3b\"},\"headline\":\"Enhance Password Security with Azure AD Password Protection\",\"datePublished\":\"2023-03-27T09:51:47+00:00\",\"dateModified\":\"2023-04-03T14:05:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138\"},\"wordCount\":826,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/#\\\/schema\\\/person\\\/3c08ee70c43dfd351fe038a7f6038d3b\"},\"image\":{\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/virtualnomad.nl\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/password-security.jpg\",\"keywords\":[\"O365\",\"Security\"],\"articleSection\":[\"Office 365\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/virtualnomad.nl\\\/?p=138#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138\",\"url\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138\",\"name\":\"Enhance Password Security with Azure AD Password Protection - Virtual Nomad\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/virtualnomad.nl\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/password-security.jpg\",\"datePublished\":\"2023-03-27T09:51:47+00:00\",\"dateModified\":\"2023-04-03T14:05:35+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/virtualnomad.nl\\\/?p=138\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138#primaryimage\",\"url\":\"https:\\\/\\\/virtualnomad.nl\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/password-security.jpg\",\"contentUrl\":\"https:\\\/\\\/virtualnomad.nl\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/password-security.jpg\",\"width\":728,\"height\":380},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/?p=138#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/virtualnomad.nl\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Enhance Password Security with Azure AD Password Protection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/#website\",\"url\":\"https:\\\/\\\/virtualnomad.nl\\\/\",\"name\":\"Virtual Nomad\",\"description\":\"a blog about the knowledge journey in Office 365 and Azure\",\"publisher\":{\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/#\\\/schema\\\/person\\\/3c08ee70c43dfd351fe038a7f6038d3b\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/virtualnomad.nl\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/#\\\/schema\\\/person\\\/3c08ee70c43dfd351fe038a7f6038d3b\",\"name\":\"Arno Geboers\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/cropped-cropped-AdobeStock_225103676-min.jpg\",\"url\":\"https:\\\/\\\/virtualnomad.nl\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/cropped-cropped-AdobeStock_225103676-min.jpg\",\"contentUrl\":\"https:\\\/\\\/virtualnomad.nl\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/cropped-cropped-AdobeStock_225103676-min.jpg\",\"width\":239,\"height\":178,\"caption\":\"Arno Geboers\"},\"logo\":{\"@id\":\"https:\\\/\\\/virtualnomad.nl\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/cropped-cropped-AdobeStock_225103676-min.jpg\"},\"sameAs\":[\"http:\\\/\\\/virtualnomad.nl\"],\"url\":\"https:\\\/\\\/virtualnomad.nl\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Enhance Password Security with Azure AD Password Protection - Virtual Nomad","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/virtualnomad.nl\/?p=138","og_locale":"en_US","og_type":"article","og_title":"Enhance Password Security with Azure AD Password Protection - Virtual Nomad","og_description":"Azure Active Directory (AD) Password Protection is an integral feature of Azure AD that safeguards users from selecting weak, easily guessable, or compromised passwords. Microsoft maintains a “global banned passwords” list that comprises passwords deemed too common. While this list remains unpublished, you can utilize Azure AD Password Protection to validate password changes against it...","og_url":"https:\/\/virtualnomad.nl\/?p=138","og_site_name":"Virtual Nomad","article_published_time":"2023-03-27T09:51:47+00:00","article_modified_time":"2023-04-03T14:05:35+00:00","og_image":[{"width":728,"height":380,"url":"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/password-security.jpg","type":"image\/jpeg"}],"author":"Arno Geboers","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Arno Geboers","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/virtualnomad.nl\/?p=138#article","isPartOf":{"@id":"https:\/\/virtualnomad.nl\/?p=138"},"author":{"name":"Arno Geboers","@id":"https:\/\/virtualnomad.nl\/#\/schema\/person\/3c08ee70c43dfd351fe038a7f6038d3b"},"headline":"Enhance Password Security with Azure AD Password Protection","datePublished":"2023-03-27T09:51:47+00:00","dateModified":"2023-04-03T14:05:35+00:00","mainEntityOfPage":{"@id":"https:\/\/virtualnomad.nl\/?p=138"},"wordCount":826,"commentCount":0,"publisher":{"@id":"https:\/\/virtualnomad.nl\/#\/schema\/person\/3c08ee70c43dfd351fe038a7f6038d3b"},"image":{"@id":"https:\/\/virtualnomad.nl\/?p=138#primaryimage"},"thumbnailUrl":"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/password-security.jpg","keywords":["O365","Security"],"articleSection":["Office 365"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/virtualnomad.nl\/?p=138#respond"]}]},{"@type":"WebPage","@id":"https:\/\/virtualnomad.nl\/?p=138","url":"https:\/\/virtualnomad.nl\/?p=138","name":"Enhance Password Security with Azure AD Password Protection - Virtual Nomad","isPartOf":{"@id":"https:\/\/virtualnomad.nl\/#website"},"primaryImageOfPage":{"@id":"https:\/\/virtualnomad.nl\/?p=138#primaryimage"},"image":{"@id":"https:\/\/virtualnomad.nl\/?p=138#primaryimage"},"thumbnailUrl":"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/password-security.jpg","datePublished":"2023-03-27T09:51:47+00:00","dateModified":"2023-04-03T14:05:35+00:00","breadcrumb":{"@id":"https:\/\/virtualnomad.nl\/?p=138#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/virtualnomad.nl\/?p=138"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualnomad.nl\/?p=138#primaryimage","url":"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/password-security.jpg","contentUrl":"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/password-security.jpg","width":728,"height":380},{"@type":"BreadcrumbList","@id":"https:\/\/virtualnomad.nl\/?p=138#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/virtualnomad.nl\/"},{"@type":"ListItem","position":2,"name":"Enhance Password Security with Azure AD Password Protection"}]},{"@type":"WebSite","@id":"https:\/\/virtualnomad.nl\/#website","url":"https:\/\/virtualnomad.nl\/","name":"Virtual Nomad","description":"a blog about the knowledge journey in Office 365 and Azure","publisher":{"@id":"https:\/\/virtualnomad.nl\/#\/schema\/person\/3c08ee70c43dfd351fe038a7f6038d3b"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/virtualnomad.nl\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/virtualnomad.nl\/#\/schema\/person\/3c08ee70c43dfd351fe038a7f6038d3b","name":"Arno Geboers","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/cropped-cropped-AdobeStock_225103676-min.jpg","url":"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/cropped-cropped-AdobeStock_225103676-min.jpg","contentUrl":"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/cropped-cropped-AdobeStock_225103676-min.jpg","width":239,"height":178,"caption":"Arno Geboers"},"logo":{"@id":"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/cropped-cropped-AdobeStock_225103676-min.jpg"},"sameAs":["http:\/\/virtualnomad.nl"],"url":"https:\/\/virtualnomad.nl\/?author=1"}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/virtualnomad.nl\/wp-content\/uploads\/2023\/03\/password-security.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/virtualnomad.nl\/index.php?rest_route=\/wp\/v2\/posts\/138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualnomad.nl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualnomad.nl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualnomad.nl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualnomad.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=138"}],"version-history":[{"count":0,"href":"https:\/\/virtualnomad.nl\/index.php?rest_route=\/wp\/v2\/posts\/138\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/virtualnomad.nl\/index.php?rest_route=\/wp\/v2\/media\/144"}],"wp:attachment":[{"href":"https:\/\/virtualnomad.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualnomad.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=138"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualnomad.nl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}