What this check looks at
For tenants synchronised from Active Directory, checks that Entra password protection is enabled on Windows Server Active Directory in Enforced mode.
In a tenant synchronised from Active Directory, most password changes happen on-premises: at the Windows sign-in screen, through Ctrl+Alt+Del, or by the service desk in Active Directory Users and Computers. Those passwords never pass Entra ID’s banned password check unless the Microsoft Entra Password Protection DC agent is installed on the domain controllers and the on-premises mode is set to Enforced.
For synchronised tenants, the check passes when password protection for Windows Server Active Directory is enabled in Enforced mode. It fails when it is in Audit mode, which only logs weak passwords and still allows them, or when it is turned off. If the setting has never been changed, Entra’s default is enabled in Audit mode, so the check fails.
Without enforcement, staff can set Company2026! or Password1 on-premises, and password hash synchronisation carries the weak password to Entra ID, where it signs in to Microsoft 365. The cloud’s banned list protects only passwords changed in the cloud, which in a synchronised organisation are a minority.
Why it matters
Passwords set on-premises never pass through Entra ID’s banned password check unless the on-premises agent enforces it. In audit mode it only reports weak passwords; enforcement is what stops them.
Password spraying against Microsoft 365 succeeds against weak passwords wherever they were set. In a synchronised firm, a spray that finds Welcome1! on one account can lead to a Microsoft 365 compromise and, with the same password, a VPN or remote desktop sign-in to the office network, which is how many ransomware incidents begin.
The agents come with Microsoft Entra ID P1, change nothing about existing passwords and add no noticeable load to domain controllers. Once enforced, people simply see the usual message that the password does not meet the requirements, and choose a better one.
The CIS Microsoft 365 Foundations Benchmark (5.2.3.3) asks for password protection to be enabled and enforced for on-premises Active Directory, and NCSC guidance and Cyber Essentials ask for common passwords to be blocked with a deny list wherever passwords are set. The rule maps to NIST CSF 2.0 PR.AA-01.
How to fix it
Where: Entra admin centre → Protection → Authentication methods → Password protection
Before you start
- Install the password protection proxy and DC agent on the domain controllers (a restart of each DC is needed).
- Run in Audit mode first and read the DC agent event logs for passwords that would have been rejected.
Step by step
- Download the agents. From Microsoft’s download site, get the Microsoft Entra Password Protection for Windows Server Active Directory package: the proxy installer (AzureADPasswordProtectionProxySetup.exe) and the DC agent installer (AzureADPasswordProtectionDCAgentSetup.msi).
- Install and register the proxy. On one or two domain-joined member servers with outbound HTTPS to Microsoft, run the proxy installer. Then, in PowerShell as a domain administrator, run Import-Module AzureADPasswordProtection, Register-AzureADPasswordProtectionProxy -AccountUpn admin@contoso.onmicrosoft.com, and once per forest Register-AzureADPasswordProtectionForest -AccountUpn admin@contoso.onmicrosoft.com, signing in with an Entra Global Administrator or Security Administrator account when prompted.
- Install the DC agent on every domain controller. Run the DC agent installer on each domain controller. Each needs a restart before the agent takes effect, so restart them one at a time, out of hours.
- Run in Audit mode first. In the Microsoft Entra admin centre, go to Entra ID > Authentication methods > Password protection. Set Enable password protection on Windows Server Active Directory to Yes and Mode to Audit, and select Save. For a week or so, each DC agent logs (Applications and Services Logs > Microsoft > AzureADPasswordProtection > DCAgent > Admin) every password it would have rejected.
- Check the agents are healthy. On the proxy server, run Get-AzureADPasswordProtectionDCAgent and Get-AzureADPasswordProtectionProxy: every domain controller and proxy should appear with a recent heartbeat. Review the audit events to see how often weak passwords are chosen.
- Tell staff and switch to Enforced. Tell staff that passwords based on common words will be refused when they next change their password. Then set Mode to Enforced in Password protection and select Save.
- Confirm. Changing a test account’s password on-premises to something like Password2026! should be refused. Password protection should show on-premises protection Yes and Mode Enforced. Re-run the assessment to confirm.
What users will notice
Password changes on-premises are checked against the same banned list as the cloud; weak ones are rejected with the usual "does not meet the requirements" message.
How to confirm it worked
Entra admin centre, Password protection: on-premises protection is Yes and Mode is Enforced; the DC agent event logs show policy enforcement.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 4: Managing data access |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | IM-6 Use strong authentication controls |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 8.3.1 All user access is authenticated |
| NIST SP 800-171 | 3.5.2 Authenticate users, processes and devices |
| CMMC Level 2 | IA.L2-3.5.2 Authentication |
| ISO 27001:2022 | A.5.17 Authentication information |
| CIS M365 | 5.2.3.3 Ensure password protection is enabled for on-premises Active Directory |
| CIS Controls v8.1 | 5.2 Use unique passwords (IG1) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Enforce password protection for Active Directory (Microsoft Learn)