CIS.M365.5.2.3.3 - (L1) Ensure password protection is enabled for on-prem Active Directory
Overview
Microsoft Entra password protection is enabled for on-premises Active Directory and runs in enforced mode.
Hybrid environments allow password changes against domain controllers. Without the on-premises integration, those changes bypass the banned password lists, so users can set passwords that the cloud would reject. Password spraying tries a few common passwords against many accounts, and the banned password list is what stops those passwords from being set. In audit mode, banned passwords are only logged and are still accepted.
The setting does not take effect until the password protection proxy service and the domain controller agent are installed. If your tenant has no on-premises Active Directory, this recommendation does not apply.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Password protection.
- Set Enable password protection on Windows Server Active Directory to Yes.
- Set Mode to Enforced. Use Audit first if you want to measure impact before enforcing.
- Select Save.
- Install the Microsoft Entra password protection proxy and domain controller agent on-premises if they are not deployed yet.
Related links
- Microsoft Entra admin center - Password protection
- Plan and deploy on-premises Microsoft Entra Password Protection
- Enforce on-premises Microsoft Entra Password Protection
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.3
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Related products | Active Directory |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1110.003 Password Spraying |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.3, nist-800-53-r5:IA-5(1) |
| PowerShell test | Test-MtCisPasswordProtectionOnPremises |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.3.3.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.3.md