EIDAUTH-013: Password Protection (Banned Passwords) Configuration
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Authentication Methods & MFA
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Entra ID Password Protection prevents users from choosing commonly compromised passwords by checking against a global banned password list maintained by Microsoft. Without password protection enabled, users can select passwords that appear in known breach databases, making accounts vulnerable to password spraying and dictionary attacks. The feature should be enabled in enforced mode for both cloud and on-premises environments.
Valor recomendado
Password protection enabled in Enforced mode with the global banned password list active
Remediación
Navigate to Entra ID > Protection > Authentication methods > Password protection. Set the mode to Enforced and ensure the global banned password list is enabled. If using hybrid identity with on-premises Active Directory, deploy the Entra ID Password Protection proxy and DC agents to extend protection to on-premises password changes.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1)
- CIS M365 Benchmark
- 5.2.5
- MITRE ATT&CK
- T1110.001, T1110.003