Enforce a custom banned password list with the organization's own terms

Description

In Microsoft Entra Password Protection, Enforce custom list is set to Yes and the Custom banned password list contains the terms specific to the organization: company and group names, brands and products, main locations, internal project names, local sports teams, and the terms listed in {{ banned_password_terms }}.

Microsoft Entra ID checks every password change and reset against the global banned list and this custom list, with normalization (case, common substitutions such as 0 for o) and fuzzy matching, then scores the remaining characters.

Do not add generic words already covered by the global list, or names of individual employees in bulk: the goal is a short list of high-value terms. The list is visible to administrators only.

Rationale

Password spray and targeted guessing start with words linked to the victim. Microsoft's global list cannot know a company's brands or city. A short custom list blocks the variants users naturally build from them, at no cost.

Impact

Users who pick a password containing a banned term get an error and must choose another one. The list holds up to 1,000 terms of 4 to 16 characters; changes can take several hours to apply. For synchronized users, the list is enforced on-premises only with CB-M365-AUTH-037.

Applies when

Requires: Microsoft Entra ID P1

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Authentication methods > Password protection.
3. Under Custom banned passwords, check that Enforce custom list is Yes and that the Custom banned password list contains the organization's names and brands, and every term of {{ banned_password_terms }}.
4. Alternative in PowerShell (Microsoft Graph, scope Directory.Read.All): (Get-MgGroupSetting | Where-Object DisplayName -eq 'Password Rule Settings').Values shows EnableBannedPasswordCheck = True and the terms in BannedPasswordList. No object means the default settings (custom list off).
5. Fail if the custom list is not enforced, is empty, or misses the company name.

Remediation

1. Draw up the list with the communication and business teams (brands, products, sites).
2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
3. Browse to Entra ID > Authentication methods > Password protection.
4. Under Custom banned passwords, set Enforce custom list to Yes and enter one term per line in Custom banned password list.
5. Select Save. Test by trying to change a test user's password to a variant of a banned term.

Rollback

Set Enforce custom list to No and save.

References

• Tutorial: Configure custom banned passwords for Microsoft Entra password protection Microsoft, vendor-doc, accessed 2026-10-24
• Eliminate bad passwords using Microsoft Entra Password Protection Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-035 Do not force periodic password expiration
• related CB-M365-AUTH-037 Enforce Microsoft Entra Password Protection on Windows Server Active Directory
• related CB-M365-AUTH-038 Lock accounts after {{ lockout_threshold }} failed sign-ins for at least {{ lockout_duration_seconds }} seconds

People and lifecycle