How to Set Up Microsoft Entra ID Password Protection to Block Common and Compromised Passwords for Your Brisbane Small Business

Summary

This guide helps you troubleshoot and resolve: How to Set Up Microsoft Entra ID Password Protection to Block Common and Compromised Passwords for Your Brisbane Small Business. Follow the steps below to fix the issue.

Common Causes

Microsoft Entra ID Password Protection helps your Brisbane small business prevent employees from using weak, commonly guessed, or previously compromised passwords. When enabled, it scans password changes and resets against Microsoft's global banned password list and any custom banned passwords you define, reducing the risk of credential-stuffing attacks and unauthorised access to your organisation's cloud services.

Requirements

• Microsoft Entra ID P1 or P2 licence (or equivalent Microsoft 365 plan)
• Global Administrator or Security Administrator role in your Entra tenant
• Azure AD Password Protection DC agent installed on domain controllers (for hybrid environments)

Password Protection applies to cloud-only users immediately. For hybrid environments using Active Directory, you must install the DC agent and proxy service on your on-premises domain controllers before on-premises password policies are enforced.

Detailed Instructions

Enable Password Protection in the Entra Admin Centre

1. Sign in to the Microsoft Entra admin centre with a Global Administrator account.
2. In the left-hand menu, select Protection, then choose Authentication methods.
3. Click Password protection.
4. Under Enable password protection on Windows Server Active Directory, set the toggle to Yes if you have on-premises domain controllers.
5. Under Mode, select Enforced to actively block banned passwords, or Audit to log attempts without blocking (recommended for initial testing).
6. Click Save.

Add Custom Banned Passwords

1. On the Password protection page, locate the Custom banned password list section.
2. Enter words specific to your organisation—for example, your business name, suburb, or industry terms—separated by commas or new lines.
3. Click Save. The list is case-insensitive and supports common substitutions (e.g., replacing "a" with "@").

Custom banned passwords are shared across your entire Entra tenant. Avoid adding generic terms that could accidentally block legitimate password choices for all users.

Install the DC Agent (Hybrid Environments Only)

1. Download the Azure AD Password Protection DC agent installer from the Microsoft Download Centre.
2. Run the installer on each domain controller with administrative privileges.
3. During installation, specify the proxy server address if your domain controllers do not have direct internet access.
4. Restart the domain controller when prompted.
5. Verify the service is running by opening Services and confirming AzureADPasswordProtectionDCAgent is set to Automatic and Running.

Troubleshooting

Password changes are not being blocked

• Confirm the mode is set to Enforced, not Audit.
• For hybrid environments, ensure the DC agent is installed and running on all domain controllers handling password changes.
• Check that the affected user accounts are synchronised to Entra ID via Microsoft Entra Connect or cloud sync.

Users cannot set a password they believe should be allowed

• Review your Custom banned password list for terms that may be too broad.
• Remember that Microsoft's global banned list is updated frequently; a password that worked previously may now be blocked.

Audit mode is useful for rolling out Password Protection without disrupting users. Review sign-in logs in the Entra admin centre to see which passwords would have been blocked before switching to Enforced mode.

If you need assistance configuring Entra ID Password Protection for your organisation, Open a Ticket with 220 Internet Services support.

Related: Password reset (Windows login)

Still Having Issues?