Microsoft Entra Password Protection: Blocking Weak Passwords Company-Wide

In this post I show how I use Microsoft Entra Password Protection to stop users from choosing easily guessed or organization-specific weak passwords — including setting up a custom banned password list.

What is Entra Password Protection?

Entra Password Protection checks every password change against a globally maintained list of commonly used, weak passwords (and variations, e.g. with character substitutions). On top of that, you can maintain your own organization-specific list.

The global banned password list

The global list is enabled by default for cloud accounts and is automatically maintained by Microsoft based on real-world attack data. No configuration is needed — it applies automatically to password changes and resets.

Setting up a custom banned password list

In the Entra admin center under Protection → Password protection, I add organization-specific terms that should additionally be blocked:

• Company name and common spellings/abbreviations
• Product names and internal project names
• Location names (e.g. the city of the headquarters)

Note: the list automatically detects common character substitutions (a↔@, o↔0, s↔$), so you don’t need to list every variant separately.

Mode: enforce vs. audit

Under “Enable password protection on Windows Server Active Directory”, hybrid environments can choose between two modes:

• Audit — violations are only logged, the password is still accepted
• Enforce — passwords that violate the policy are actively rejected

I recommend running new environments in audit mode first, to gauge the impact on existing password habits before enforcing.

Smart Lockout

On top of that I enable Smart Lockout, which temporarily locks accounts after several failed sign-in attempts and distinguishes between known and unknown locations, making brute-force attacks harder without unnecessarily locking out legitimate users.

Hybrid environments: Password Protection Proxy

If you still run an on-premises Active Directory, you can install the Password Protection Proxy and Password Protection DC Agent so the same banned password list also applies to password changes directly against on-prem AD.

Conclusion

Entra Password Protection is one of the best effort-to-benefit security measures available: set it up once, and it quietly runs in the background, preventing a large share of the weakest, most easily guessed passwords across the organization.