(L1) Ensure custom banned passwords lists are used

Contributed by jeremy finneyAll contributors →

Part of CIS · Entra ID · Password protection · All checks

Run this check

Invoke-Maester -TestId CIS.M365.5.2.3.2

Overview

The custom banned password list in Microsoft Entra password protection is enabled and contains at least one word.

Password spray attacks try a small number of likely passwords against many accounts. Global banned passwords cover common choices, but words that are specific to your organisation, such as brand names, product names, locations and project names, are not covered unless you add them to the custom list.

The custom list is checked when a user changes or resets a password. Existing passwords are not affected until they change.

Remediation action

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Authentication methods > Password protection.
3. Set Enforce custom list to Yes.
4. Enter the words to block in Custom banned password list, one per line.
5. Select Save.

Related links

• Microsoft Entra admin center - Password protection
• Eliminate bad passwords using Microsoft Entra Password Protection
• Configure custom banned passwords
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.2

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.5.2.3.2
Severity	Medium
Suite	CIS
Product	Entra ID
Feature	Password protection
Area	Authentication
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1110.003 Password Spraying
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.2
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:5.2.3.2, nist-800-53-r5:IA-5(1)
PowerShell test	Test-MtCisCustomBannedPasswordList
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cis/Test.CIS.M365.5.2.3.2.ps1
• Documentation: tests/cis/Test.CIS.M365.5.2.3.2.md