Question

Your organization is deployed on Microsoft Entra ID P2. Users keep choosing weak passwords that incorporate the company name 'Contoso' and the local sports team 'Wildcats'. You want to prevent users from setting cloud passwords that contain these terms or their common variations (such as 'Contoso123' or 'C0ntoso'), while retaining Microsoft's global banned password list. What should you configure?

Accepted Answer

Add the terms to the custom banned password list in Microsoft Entra Password Protection and enable enforcement

Answer

Create a Conditional Access policy that blocks sign-ins using compromised passwords

Answer

Configure a password policy in the Microsoft 365 admin center to require a minimum length of 16 characters

Answer

Enable the Microsoft Entra ID Protection user risk policy set to require a password change