Question

Contoso reports that users keep setting weak passwords that include the company name and local sports teams, and these passwords are passing on-premises Active Directory domain controllers. You have deployed Microsoft Entra Password Protection with the DC agents and proxy service installed. You need to ensure that the terms 'Contoso', 'Seahawks', and 'Mariners' (and common variations) are blocked when users change or reset their passwords in the on-premises domain. What should you do?

Accepted Answer

Add the terms to the custom banned password list in the Authentication methods > Password protection settings in the Entra admin center and confirm the mode is set to Enforced.

Answer

Create a fine-grained password policy in Active Directory Administrative Center and add the banned terms to the policy.

Answer

Add the terms to a Group Policy Object linked to the domain controllers' OU under Account Policies.

Answer

Enable the global banned password list only, since Microsoft automatically detects and blocks company-specific terms.