Description:
This control ensures that a strong password policy is enforced for all users within the Microsoft 365 tenant. Strong password requirements help protect user accounts from unauthorized access by requiring passwords that are resistant to guessing, brute-force attacks, and credential compromise.
Rationale:
Weak passwords are a common cause of account compromise. Enforcing strong password requirements reduces the likelihood of unauthorized access and helps protect organizational resources from credential-based attacks.
Impact:
Reduces the risk of unauthorized access due to weak passwords.
Improves overall account security.
Supports compliance requirements related to identity and access management.
Helps protect organizational resources from credential-based attacks.
May require users to update passwords to meet policy requirements.
Default Value:
Microsoft Entra ID provides default password protections, but administrators should explicitly configure password protection and password policies to align with organizational security requirements.
Remediation
Test Plan
Sign in to the Microsoft Entra admin center with administrative privileges.
Navigate to Protection → Authentication methods → Password protection.
Review the configured password protection settings.
Verify that password protection is enabled and configured according to organizational policy.
Attempt to create or change a user password to a weak or commonly used password.
Verify that the weak password is rejected.
Verify that users are required to use passwords that comply with the configured policy.
If strong password requirements are not configured or enforced, follow the Implementation Plan to remediate the issue and repeat the test.
Implementation Steps:
Sign in to the Microsoft Entra admin center with Global Administrator privileges.
Navigate to Protection → Authentication methods → Password protection.
Configure Custom banned password list according to organizational requirements.
Set Enable password protection on Windows Server Active Directory as required.
Configure Lockout threshold according to organizational policy.
Configure Lockout duration in seconds according to organizational policy.
Save the configuration changes.
Verify that weak and commonly used passwords are blocked.
Verify that password protection settings are applied to all applicable users.
Backout Plan:
Sign in to the Microsoft Entra admin center with Global Administrator privileges.
Navigate to Protection → Authentication methods → Password protection.
Modify the password protection settings as required.
Remove entries from the custom banned password list if necessary.
Save the configuration changes.
Verify that password requirements reflect the updated configuration.
References: