Azure AD Password Protection

How often do you see users do the following things:

1. Write their password on a post-it and stick it on their laptop or monitor
2. Add a +1 when they need to reset their password for example they go from P@ssw0rd01 to P@ssw0rd02. That really made it harder.
3. Create a default password like "P@ssw0rd" or "123456789" Yeah they sometimes add a 123 to make it "Difficult" haha

Now to be honest now a days you need a lot of passwords to login into all those services on the www. Keeping track of them is a difficult task. Writing them down in a notepad and storing it on your computer is NOT the way to go! To make life easier for them users got "creative". For example they use the company name + a number to keep their password. For example "AcmeCompany123". Once they had to change their password they would make it "AcmeCompany234"

As an IT admin preventing the use of these passwords is something that is hard to do. You could train the users in not using the following top 10 of passwords (Wikipedia):

Rank	2011[4]	2012[5]	2013[6]	2014[7]	2015[8]	2016[3]	2017[9]
1	password	password	123456	123456	123456	123456	123456
2	123456	123456	password	password	password	password	password
3	12345678	12345678	12345678	12345	12345678	12345	12345678
4	qwerty	abc123	qwerty	12345678	qwerty	12345678	qwerty
5	abc123	qwerty	abc123	qwerty	12345	football	12345
6	monkey	monkey	123456789	123456789	123456789	qwerty	123456789
7	1234567	letmein	111111	1234	football	1234567890	letmein
8	letmein	dragon	1234567	baseball	1234	1234567	1234567
9	trustno1	111111	iloveyou	dragon	1234567	princess	football
10	dragon	baseball	adobe123[a]	football	baseball	1234	iloveyou

But Microsoft introduced a feature in Azure AD to prevent users from filling in the easy to guess passwords.

Password protection (preview)

Password Protection enables admins to prevent users from creating passwords based on default words that are easy to guess. This prevents hackers from using the Password spray to find the passwords. 

The interface.

• Lockout threshold - The amount of sign-ins are allowed before the account is blocked. Keep in mind that once the account is unlocked and the users fills in the wrong password the account is directly blocked.
• Lockout duration in seconds - determine how many the user is blocked till the account is un-blocked again. 
• Enforce custom set - Choose if you want to use a custom list of passwords for your organization. Note: Microsoft keeps track of common or compromised passwords (1) and blocks these in the Office 365 tenant to enhance the security.
• Custom banned password list - This is a great way to create a list of passwords that are banned from your organization. Azure AD also understands the variations (2) of the passwords in the list. For example if you fill in acme as a word that has to be blocked if a user tries to use @cme or Acme123 they are variations on acme and so they will be blocked. Pretty cool hey?! Keep in mind though that it could be that banned passwords are allowed but only if they contain 5+ points. See how Microsoft scores passwords below.

Basically, we calculate a score for each password, where each character is worth a point, but any substring that matches a banned word/phrase/pattern is only worth one point in total. So:

Spring2018 = [Spring] + [2018] = 2 points

Spring2018asdfj236 = [Spring] + [2018] + [asdf] + [f] + [j] + [2] + [3] + [6] = 8 points

This lets users have passwords that are hard to guess even if they happen to contain some banned phrases. Our cutoff is currently 5+ points, and that's in addition to any other length or complexity rules.

• Enable password protection on Windows Server active directory - If you install the agent(3) on the server you can enable the same policies on your AD as you do in the Cloud. 
• Mode - This is a good one to keep in mind. You have 2 options:
• Enforced - Users will not be able to set their password to the passwords you banned in the list
• Audit - Users can use the passwords in the list but it will be logged. I think this is a cool feature because a lot of users will be using the passwords you defined and tracking them can be useful to train/inform users about the risks of a bad password. 

If you want a more in dept article about Password Protection for Azure AD please look at: https://www.semperis.com/azure-ad-password-protection/ 

Keep in mind! 

1. Blocking bad passwords is a start but it's not 100% bullet proof. Use MFA to give users an extra layer of protection. 
2. Having users reset their passwords every month will enable users to become less creative in writing a new password. A complex password is still complex in a year so stop the password renewal and focus on adding security like MFA or conditional access. 

Resources

https://techcommunity.microsoft.com/t5/Azure-Active-Directory-AMA/Point-scoring-system/m-p/210405/thread-id/38#M50