Enforce Microsoft Entra Password Protection on Windows Server Active Directory

Description

Enable password protection on Windows Server Active Directory is set to Yes and Mode is set to Enforced. The Microsoft Entra Password Protection proxy service and the DC agent are installed (proxy on at least two member servers, agent on every domain controller), so that each password change or reset in Active Directory is checked against the global and custom banned password lists (CB-M365-AUTH-036).

The DC agent only validates new passwords; existing weak passwords stay until the next change. A domain controller without the agent accepts any password that meets the Active Directory policy, so the coverage must be complete. Agents report their health in the DC event logs and through Get-AzureADPasswordProtectionDCAgent.

Rationale

For synchronized users the password is set on-premises: the cloud check never runs. Without the DC agent, the organization's custom list and Microsoft's global list do not apply to most of its accounts, and those passwords also protect the Active Directory itself.

Impact

Software must be installed on every domain controller (a reboot is needed for the DC agent) and on proxy servers with outbound HTTPS to Microsoft Entra ID. In Enforced mode, password changes that hit a banned term are refused with a generic complexity error; tell the help desk. Run in Audit mode first to measure the rejection rate.

Applies when

Requires: Microsoft Entra ID P1, Identities synchronized from Active Directory (Microsoft Entra Connect or Cloud Sync)

Setting

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Authentication methods > Password protection.
3. Under Password protection for Windows Server Active Directory, check that Enable password protection on Windows Server Active Directory is Yes and Mode is Enforced.
4. Alternative in PowerShell (Microsoft Graph, scope Directory.Read.All): (Get-MgGroupSetting | Where-Object DisplayName -eq 'Password Rule Settings').Values shows EnableBannedPasswordCheckOnPremises = True and BannedPasswordCheckOnPremisesMode = Enforce.
5. On a server with the proxy module, run Get-AzureADPasswordProtectionDCAgent (read-only) and compare the list with all domain controllers of each domain (Get-ADDomainController -Filter *); check that each agent has a recent heartbeat.
6. Fail if the mode is Audit, if the feature is disabled, or if a domain controller has no agent.

Remediation

1. Install the Microsoft Entra Password Protection proxy service on at least two member servers and register it (Register-AzureADPasswordProtectionProxy, Register-AzureADPasswordProtectionForest), with an account that is Global Administrator or Security Administrator in the tenant and Domain Admin in the root domain.
2. Install the DC agent on every domain controller and reboot them in turn.
3. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator, browse to Entra ID > Authentication methods > Password protection, set Enable password protection on Windows Server Active Directory to Yes and Mode to Audit, and save.
4. Review the DC agent events (Applications and Services Logs > Microsoft > AzureADPasswordProtection

   DCAgent > Admin) for a few weeks, then set Mode to Enforced and save.

Rollback

Set Mode back to Audit. Uninstalling the DC agent is the last resort.

References

• Enable on-premises Microsoft Entra Password Protection Microsoft, vendor-doc, accessed 2026-10-24
• Plan and deploy on-premises Microsoft Entra Password Protection Microsoft, vendor-doc, accessed 2026-10-24
• Enforce on-premises Microsoft Entra Password Protection for Active Directory Domain Services Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-036 Enforce a custom banned password list with the organization's own terms
• related CB-M365-AUTH-044 Enable password hash synchronization for synchronized identities

People and lifecycle