(L1) Ensure password protection is enabled for on-prem Active Directory

Contributed by jeremy finneyAll contributors →

Part of CIS · Entra ID · Password protection · All checks

Run this check

Invoke-Maester -TestId CIS.M365.5.2.3.3

Overview

Microsoft Entra password protection is enabled for on-premises Active Directory and runs in enforced mode.

Hybrid environments allow password changes against domain controllers. Without the on-premises integration, those changes bypass the banned password lists, so users can set passwords that the cloud would reject. Password spraying tries a few common passwords against many accounts, and the banned password list is what stops those passwords from being set. In audit mode, banned passwords are only logged and are still accepted.

The setting does not take effect until the password protection proxy service and the domain controller agent are installed. If your tenant has no on-premises Active Directory, this recommendation does not apply.

Remediation action

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Authentication methods > Password protection.
3. Set Enable password protection on Windows Server Active Directory to Yes.
4. Set Mode to Enforced. Use Audit first if you want to measure impact before enforcing.
5. Select Save.
6. Install the Microsoft Entra password protection proxy and domain controller agent on-premises if they are not deployed yet.

Related links

• Microsoft Entra admin center - Password protection
• Plan and deploy on-premises Microsoft Entra Password Protection
• Enforce on-premises Microsoft Entra Password Protection
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.3

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.5.2.3.3
Severity	Medium
Suite	CIS
Product	Entra ID
Related products	Active Directory
Feature	Password protection
Area	Authentication
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1110.003 Password Spraying
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.3
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:5.2.3.3, nist-800-53-r5:IA-5(1)
PowerShell test	Test-MtCisPasswordProtectionOnPremises
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/cis/Test.CIS.M365.5.2.3.3.ps1
• Documentation: tests/cis/Test.CIS.M365.5.2.3.3.md