Microsoft Entra ID must, for password-based authentication, verify when users create or update passwords that the passwords are not found on the list of commonly used, expected, or compromised passwords

Contributed by Merill FernandoAll contributors →

Part of DISA · Entra ID · Password protection · All checks

Run this check

Invoke-Maester -TestId DISA.V-270475

Overview

Microsoft Entra password protection enforces a custom banned password list that holds entries. (DISA Microsoft Entra ID STIG, V-270475, CAT II).

Users pick passwords from what is around them: the organization’s name, products and places. A custom banned password list stops those words, on top of the global list Microsoft maintains.

DISA’s check requires Enforce custom list set to Yes and a list that is not empty. This test runs CIS.M365.5.2.3.2, which checks both.

Remediation action

1. In the Microsoft Entra admin center, go to Entra ID > Authentication methods > Password protection.
2. Set Enforce custom list to Yes and add terms specific to your organization to Custom banned password list.
3. Select Save.

Related links

• DISA Microsoft Entra ID STIG: V-270475
• Eliminate bad passwords using Microsoft Entra Password Protection

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-270475
Severity	Medium
Suite	DISA
Product	Entra ID
Feature	Password protection
Area	Authentication
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1110.003 Password Spraying
Supports benchmark	DISA Microsoft Entra ID STIG (version V1R2), requirement V-270475
Supports controls	disa-stig-entra-id:V-270475, nist-800-53-r5:IA-5(1)
PowerShell test	Test-MtDisaEntraBannedPasswordList
Services	Graph
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/disa/Test.DISA.V-270475.ps1
• Documentation: tests/disa/Test.DISA.V-270475.md