{
  "id": "CB-M365-AUTH-037",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-037",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-037.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-037.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-037",
    "title": "Enforce Microsoft Entra Password Protection on Windows Server Active Directory",
    "finding": {
      "title": "Banned password lists are not enforced on on-premises domain controllers",
      "description": "Users of synchronized accounts can set weak passwords on-premises, which are then synchronized and accepted for cloud sign-in."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "passwords",
      "password-protection",
      "active-directory",
      "hybrid",
      "banned-passwords"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P1",
        "Identities synchronized from Active Directory (Microsoft Entra Connect or Cloud Sync)"
      ]
    },
    "description": "**Enable password protection on Windows Server Active Directory** is set to **Yes** and **Mode** is\nset to **Enforced**. The Microsoft Entra Password Protection proxy service and the DC agent are\ninstalled (proxy on at least two member servers, agent on every domain controller), so that each\npassword change or reset in Active Directory is checked against the global and custom banned\npassword lists (CB-M365-AUTH-036).\n",
    "rationale": "For synchronized users the password is set on-premises: the cloud check never runs. Without the\nDC agent, the organization's custom list and Microsoft's global list do not apply to most of its\naccounts, and those passwords also protect the Active Directory itself.\n",
    "impact": "Software must be installed on every domain controller (a reboot is needed for the DC agent) and\non proxy servers with outbound HTTPS to Microsoft Entra ID. In **Enforced** mode, password changes\nthat hit a banned term are refused with a generic complexity error; tell the help desk. Run in\n**Audit** mode first to measure the rejection rate.\n",
    "notes": "The DC agent only validates new passwords; existing weak passwords stay until the next change. A\ndomain controller without the agent accepts any password that meets the Active Directory policy,\nso the coverage must be complete. Agents report their health in the DC event logs and through\n`Get-AzureADPasswordProtectionDCAgent`.\n",
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Authentication methods > Password protection > Password protection for Windows Server Active Directory",
      "default_value": "Enable password protection on Windows Server Active Directory = Yes, Mode = Audit",
      "recommended_value": "Enable = Yes, Mode = Enforced, DC agent on every domain controller"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Password protection**.\n3. Under **Password protection for Windows Server Active Directory**, check that **Enable\n   password protection on Windows Server Active Directory** is **Yes** and **Mode** is\n   **Enforced**.\n4. Alternative in PowerShell (Microsoft Graph, scope `Directory.Read.All`):\n   `(Get-MgGroupSetting | Where-Object DisplayName -eq 'Password Rule Settings').Values`\n   shows `EnableBannedPasswordCheckOnPremises` = `True` and\n   `BannedPasswordCheckOnPremisesMode` = `Enforce`.\n5. On a server with the proxy module, run `Get-AzureADPasswordProtectionDCAgent` (read-only)\n   and compare the list with all domain controllers of each domain (`Get-ADDomainController\n   -Filter *`); check that each agent has a recent heartbeat.\n6. Fail if the mode is **Audit**, if the feature is disabled, or if a domain controller has no\n   agent.\n"
    },
    "remediation": {
      "manual": "1. Install the Microsoft Entra Password Protection proxy service on at least two member servers\n   and register it (`Register-AzureADPasswordProtectionProxy`,\n   `Register-AzureADPasswordProtectionForest`), with an account that is Global Administrator or\n   Security Administrator in the tenant and Domain Admin in the root domain.\n2. Install the DC agent on every domain controller and reboot them in turn.\n3. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator, browse to **Entra ID** > **Authentication methods** > **Password protection**,\n   set **Enable password protection on Windows Server Active Directory** to **Yes** and **Mode**\n   to **Audit**, and save.\n4. Review the DC agent events (Applications and Services Logs > Microsoft > AzureADPasswordProtection\n   > DCAgent > Admin) for a few weeks, then set **Mode** to **Enforced** and save.\n",
      "rollback": "Set **Mode** back to **Audit**. Uninstalling the DC agent is the last resort.\n"
    },
    "references": [
      {
        "title": "Enable on-premises Microsoft Entra Password Protection",
        "url": "https://learn.microsoft.com/entra/identity/authentication/howto-password-ban-bad-on-premises-operations",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Plan and deploy on-premises Microsoft Entra Password Protection",
        "url": "https://learn.microsoft.com/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Enforce on-premises Microsoft Entra Password Protection for Active Directory Domain Services",
        "url": "https://learn.microsoft.com/entra/identity/authentication/concept-password-ban-bad-on-premises",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5(1)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1110.003"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-036",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-044",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}