Stops people picking easily guessed passwords, close variations of them and words linked to your own organisation, checking against Microsoft's global banned list and any custom list you add. Agents can extend it to on-premises Active Directory.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Microsoft Entra Password Protection in context, with comparison tables and the common traps.
Terms in this definition
- AGDLP
Nesting pattern: users go into global groups, which go into domain local groups, which receive the permissions. AGUDLP adds universal groups for forests with several domains.
- List
Permission on Key Vault secrets allowing a caller to enumerate those in a vault, though their values are not returned.
- Architecture Definition Document
A key deliverable bringing together the main architecture artifacts across the four domains for every relevant state: baseline, transition and target. It sets out, in qualitative terms, what the architect intends.
- AD
Short for Active Directory, the directory service built into Windows Server (AD DS). Entra Connect synchronises on-premises forests to Microsoft Entra ID.
Related terms
- Custom banned password list
Up to 1,000 words specific to an organisation, such as product names or locations, that Microsoft Entra Password Protection refuses in passwords, on top of Microsoft's global list. On-premises AD DS can enforce it too.
- Global banned password list
A list of weak, frequently attacked passwords that Microsoft keeps up to date from its own security signals. Microsoft Entra Password Protection enforces it for every tenant, and administrators cannot change its contents.
See Microsoft Entra Password Protection in the full glossary