Skip to main content

📝 Microsoft Entra ID Custom Banned Password List is not enforced 🟢

  • Contextual name: 📝 Custom Banned Password List is not enforced 🟢
  • ID: /ce/ca/azure/microsoft-entra-id/custom-banned-password-list
  • Located in: 📁 Microsoft Entra ID

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Description​

Open File

Description​

Microsoft Azure provides a Global Banned Password policy that applies to Azure administrative and normal user accounts. This is not applied to user accounts that are synced from an on-premise Active Directory unless Microsoft Entra ID Connect is used and you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers. Please see the list in default values on the specifics of this policy. To further password security, it is recommended to further define a custom banned password policy.

Rationale​

Enabling this gives your organization further customization on what secure passwords are allowed. Setting a bad password list enables your organization to fine-tune its password policy further, depending on your needs. Removing easy-to-guess passwords increases the security of access to your Azure resources.

Impact​

Increasing needed password complexity might increase overhead on administration of user accounts. Licensing requirement for Global Banned Password List and Custom Banned Password list requires Microsoft Entra ID P1 or P2. On-premises Active Directory Domain Services users that are not synchronized to Microsoft Entra ID also benefit from Microsoft Entra ID Password Protection based on existing licensing for synchronized users.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. From Azure Home select the Portal Menu.
  2. Select Microsoft Entra ID.
  3. Under Manage, select Security.
  4. Under Manage, select Authentication Methods.
  5. Under Manage, select Password Protection.
  6. Set the Enforce custom list option to Yes.
  7. Click in the Custom banned password list text box to add a string.
  8. Click Save.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS Azure v2.1.0 → 💼 1.6 Ensure that a Custom Bad Password List is set to 'Enforce' for your Organization - Level 1 (Manual)1
💼 CIS Azure v3.0.0 → 💼 2.8 Ensure that a Custom Bad Password List is set to 'Enforce' for your Organization (Manual)1
💼 Cloudaware Framework → 💼 Credential Lifecycle Management17