{
  "id": "CB-M365-AUTH-036",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-036",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-036.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-036.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-036",
    "title": "Enforce a custom banned password list with the organization's own terms",
    "finding": {
      "title": "Passwords built on the company name or brands are accepted",
      "description": "Attackers spray passwords such as Company2026! first, and only Microsoft's global list blocks the most common ones."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "passwords",
      "password-protection",
      "banned-passwords",
      "password-spray"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1"
      ]
    },
    "description": "In Microsoft Entra Password Protection, **Enforce custom list** is set to **Yes** and the **Custom\nbanned password list** contains the terms specific to the organization: company and group names,\nbrands and products, main locations, internal project names, local sports teams, and the terms\nlisted in `{{ banned_password_terms }}`.\n\nMicrosoft Entra ID checks every password change and reset against the global banned list and\nthis custom list, with normalization (case, common substitutions such as 0 for o) and fuzzy\nmatching, then scores the remaining characters.\n",
    "rationale": "Password spray and targeted guessing start with words linked to the victim. Microsoft's global list\ncannot know a company's brands or city. A short custom list blocks the variants users naturally\nbuild from them, at no cost.\n",
    "impact": "Users who pick a password containing a banned term get an error and must choose another one. The\nlist holds up to 1,000 terms of 4 to 16 characters; changes can take several hours to apply. For\nsynchronized users, the list is enforced on-premises only with CB-M365-AUTH-037.\n",
    "notes": "Do not add generic words already covered by the global list, or names of individual employees in\nbulk: the goal is a short list of high-value terms. The list is visible to administrators only.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Authentication methods > Password protection > Custom banned passwords",
      "default_value": "Enforce custom list = No",
      "recommended_value": "Enforce custom list = Yes, list contains the organization's terms"
    },
    "parameters": [
      {
        "name": "banned_password_terms",
        "type": "list",
        "description": "Organization-specific terms to ban (company, brand and product names, locations). Filled in during tailoring.",
        "default": []
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Password protection**.\n3. Under **Custom banned passwords**, check that **Enforce custom list** is **Yes** and that the\n   **Custom banned password list** contains the organization's names and brands, and every term of\n   {{ banned_password_terms }}.\n4. Alternative in PowerShell (Microsoft Graph, scope `Directory.Read.All`):\n   `(Get-MgGroupSetting | Where-Object DisplayName -eq 'Password Rule Settings').Values`\n   shows `EnableBannedPasswordCheck` = `True` and the terms in `BannedPasswordList`. No object\n   means the default settings (custom list off).\n5. Fail if the custom list is not enforced, is empty, or misses the company name.\n"
    },
    "remediation": {
      "manual": "1. Draw up the list with the communication and business teams (brands, products, sites).\n2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n3. Browse to **Entra ID** > **Authentication methods** > **Password protection**.\n4. Under **Custom banned passwords**, set **Enforce custom list** to **Yes** and enter one term\n   per line in **Custom banned password list**.\n5. Select **Save**. Test by trying to change a test user's password to a variant of a banned\n   term.\n",
      "rollback": "Set **Enforce custom list** to **No** and save.\n"
    },
    "references": [
      {
        "title": "Tutorial: Configure custom banned passwords for Microsoft Entra password protection",
        "url": "https://learn.microsoft.com/entra/identity/authentication/tutorial-configure-custom-password-protection",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Eliminate bad passwords using Microsoft Entra Password Protection",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-password-ban-bad",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-mfa",
        "framework_version": "2.0",
        "id": "R27",
        "relation": "partial",
        "note": "ANSSI asks for a strength check at password creation; Microsoft's global list does most of it and ours adds organization-specific terms."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5(1)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1110.003"
      },
      {
        "framework": "mitre-attack",
        "id": "T1110.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-035",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-037",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-038",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}