CIS.M365.5.2.3.2 - (L1) Ensure custom banned passwords lists are used
Overview
The custom banned password list in Microsoft Entra password protection is enabled and contains at least one word.
Password spray attacks try a small number of likely passwords against many accounts. Global banned passwords cover common choices, but words that are specific to your organisation, such as brand names, product names, locations and project names, are not covered unless you add them to the custom list.
The custom list is checked when a user changes or resets a password. Existing passwords are not affected until they change.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Password protection.
- Set Enforce custom list to Yes.
- Enter the words to block in Custom banned password list, one per line.
- Select Save.
Related links
- Microsoft Entra admin center - Password protection
- Eliminate bad passwords using Microsoft Entra Password Protection
- Configure custom banned passwords
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.2
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110.003 Password Spraying |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.2, nist-800-53-r5:IA-5(1) |
| PowerShell test | Test-MtCisCustomBannedPasswordList |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.3.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.2.md