Runs on every writable domain controller as a password filter, checking each password change against banned password lists downloaded earlier. A restart is needed after installing it, and if the proxy is down it keeps enforcing the policy it has cached.
Also called Microsoft Entra Password Protection DC agent.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains DC agent in context, with comparison tables and the common traps.
Terms in this definition
- Agents (classic) API
First-generation Foundry Agent Service API, based on threads, messages and runs. It is deprecated, replaced by conversations and responses, and retires on 31 March 2027.
- DC
A server running AD DS. Placing these servers in Azure as well as on-premises keeps synchronisation and user sign-in working if one location fails.
- FILTER
Returns just those rows of a table that meet a condition. In CALCULATE it handles conditions too complex for a Boolean filter argument, though a Boolean filter is faster whenever one will work.
- EARLIER
Within nested DAX row contexts, lets an inner calculation read a column as it stood in an outer pass; EARLIEST jumps to the outermost. Most people now use variables, which read more clearly.
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.