# (L1) Ensure custom banned passwords lists are used

The custom banned password list in Microsoft Entra password protection is enabled and contains at least one word.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.3.2

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Password protection · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.3.2
```

## Overview

The custom banned password list in Microsoft Entra password protection is enabled and contains at least one word.

Password spray attacks try a small number of likely passwords against many accounts. Global banned passwords cover common choices, but words that are specific to your organisation, such as brand names, product names, locations and project names, are not covered unless you add them to the custom list.

The custom list is checked when a user changes or resets a password. Existing passwords are not affected until they change.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Authentication methods** > [**Password protection**](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection).
3. Set **Enforce custom list** to **Yes**.
4. Enter the words to block in **Custom banned password list**, one per line.
5. Select **Save**.

#### Related links

* [Microsoft Entra admin center - Password protection](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection)
* [Eliminate bad passwords using Microsoft Entra Password Protection](https://learn.microsoft.com/entra/identity/authentication/concept-password-ban-bad)
* [Configure custom banned passwords](https://learn.microsoft.com/entra/identity/authentication/tutorial-configure-custom-password-protection)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.2](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.3.2 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110.003 Password Spraying |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.2, nist-800-53-r5:IA-5(1) |
| PowerShell test | [Test-MtCisCustomBannedPasswordList](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.2.ps1) |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.3.2.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.2.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.3.2.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.2.md)