--- title: "How to Protect Passwords with an Azure AD Password Policy" description: "Learn how to set up Azure AD Password Protection and create an Azure AD password policy in this step-by-step guide!" canonical: "https://adamtheautomator.com/azure-ad-password-policy/" --- # How to Protect Passwords with an Azure AD Password Policy > Learn how to set up Azure AD Password Protection and create an Azure AD password policy in this step-by-step guide! Source: https://adamtheautomator.com/azure-ad-password-policy/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![How to Protect Passwords with an Azure AD Password Policy](https://adamtheautomator.com/wp-content/uploads/2022/02/How-to-Protect-Passwords-with-an-Azure-AD-Password-Policy.jpg) # How to Protect Passwords with an Azure AD Password Policy [![](https://secure.gravatar.com/avatar/9a14f10ff1b1ec7d790d34f5b559e4d3de2d31b172e6ef266dfd8b479174d97b?s=192&d=mm&r=g)June Castillote](https://adamtheautomator.com/author/june/)22 February 20227 min. read Categories: [Cloud](/category/cloud/) Tags:[Active Directory](/tag/active-directory/)[Azure](/tag/azure/)[Specops](/tag/specops/)[Sponsored](/tag/sponsored/) Table of Contents * [Prerequisites](#prerequisites) * [Installing and Configuring the Azure AD Password Protection Proxy Service](#installing-and-configuring-the-azure-ad-password-protection-proxy-service) * [Installing the Azure AD Password Protection DC Agent](#installing-the-azure-ad-password-protection-dc-agent) * [Configuring the Azure AD Password Protection Settings in the Azure Portal](#configuring-the-azure-ad-password-protection-settings-in-the-azure-portal) * [Checking the Azure AD Password Protection Status](#checking-the-azure-ad-password-protection-status) * [Testing the Azure AD Password Protection Policy](#testing-the-azure-ad-password-protection-policy) * [Testing Password Change via Windows](#testing-password-change-via-windows) * [Testing Password Change via Azure AD](#testing-password-change-via-azure-ad) * [Securing Passwords with Specops Password Policy](#securing-passwords-with-specops-password-policy) * [User Experience](#user-experience) * [Extensive Breached Password List](#extensive-breached-password-list) * [Custom Banned Password List](#custom-banned-password-list) * [Conclusion](#conclusion) You can educate users about using strong passwords but they’ll probably still do what’s easy for them — use weak passwords. Fortunately, you can prevent users from creating weak passwords by implementing [Azure AD Password Protection](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises). In this article, you’ll learn how to enable and configure Azure AD Password Protection for your Azure AD tenant and on-premises AD. Also, learn what you can do with Azure AD Password Protection and about its limitations. Would the Azure AD Password Protection features be enough or is there something better? Read on and find out! > _**This post is kindly sponsored by [Specops Software](https://specopssoft.com/?utm_source=ata&utm_medium=referral&utm_campaign=na_2022_ata&utm_content=post).**_ ## Prerequisites Should you plan to follow along with this tutorial, make sure to have the requirements in place as follows. * On-premises Active Directory (AD) connected to Azure Active Directory via Azure AD Connect. Related:[How To Connect Azure AD to Office 365 with Azure AD Connect](https://adamtheautomator.com/connect-azure-ad-to-office-365/) * A domain controller (DC) where you’ll install the _Azure AD Password Protection DC Agent_. This tutorial will be using a DC named _**phdc3.lzex.ml**_. * A member server with internet access to install the _Azure AD Password Protection Proxy Service_. This tutorial will be using a member server named _**phprxy1.lzex.ml**_. * Your servers must have the [**Universal C Runtime**](https://support.microsoft.com/en-us/topic/update-for-universal-c-runtime-in-windows-c0514201-7fe6-95a3-b0a5-287930f3560c) where applicable. * You have a Global Administrator account role in Azure AD. * You have domain administrator privileges on your on-premises AD. * Download the required Azure AD Password Protection software from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=57071). Copy the _**AzureADPasswordProtectionProxySetup.msi**_ file to the member server, and the _**AzureADPasswordProtectionDCAgentSetup.msi**_ to the DC. ## Installing and Configuring the Azure AD Password Protection Proxy Service The Azure AD Password Protection Proxy Service is the first of the two components of Azure AD Password Protection. The Azure AD Password Protection Proxy Service role is to communicate with Azure AD and maintain a copy of the global and custom banned passwords list. To install this Azure AD Password Protection Proxy Service, follow the below steps. 1\. Login to the member server. 2\. Locate and run the _**AzureADPasswordProtectionProxySetup.msi**_ installer you downloaded. 3\. On the **Azure AD Password Protection Proxy Setup**, check the **I accept the terms in the License Agreement** box and click **Install**. ![Accept the license agreement](https://adamtheautomator.com/wp-content/uploads/2022/02/image-286.png) Accept the license agreement 4\. Wait for the installation to complete and click **Finish**. ![Completing the installation](https://adamtheautomator.com/wp-content/uploads/2022/02/image-287.png) Completing the installation 5\. After the installation, verify that the AzureADPasswordProtectionProxy service status is running. To do so, open PowerShell as admin and run the command below. ```powershell Get-Service AzureADPasswordProtectionProxy | Format-List ``` The image below confirms the AzureADPasswordProtectionProxy service is running. ![Viewing the AzureADPasswordProtectionProxy service status](https://adamtheautomator.com/wp-content/uploads/2022/02/image-288.png) Viewing the AzureADPasswordProtectionProxy service status 6\. Now that you’ve installed and confirmed the AzureADPasswordProtectionProxy service, you still need to register the proxy to Azure AD. To register the proxy service, run the command `Register-AzureADPasswordProtectionProxy` below in PowerShell. Ensure that the -AccountUpn value is the Azure AD account with the Global admin role. This command will prompt you to enter the account credentials interactively. ```powershell Register-AzureADPasswordProtectionProxy -AccountUpn ``` 7\. Next, run the `Register-AzureADPasswordProtectionForest` command to register your on-premises AD forest with Azure AD. Similar to the previous command, the `-AccountUpn` value should also be the Global admin account. ```powershell Register-AzureADPasswordProtectionForest -AccountUpn ``` ## Installing the Azure AD Password Protection DC Agent The final component to install is the Azure AD Password Protection DC Agent. This agent applies the filtering during password changes and is also responsible for requesting the password policy from Azure AD via the Azure AD Password Protection service. Follow the instructions below to install the Azure AD Password Protection DC Agent. 1\. Login to the domain controller. 2\. Locate and run the _**AzureADPasswordProtectionDCAgentSetup.msi**_ installer you downloaded. 3\. On the **Azure AD Password Protection DC Agent Setup**, check the **I accept the terms in the License Agreement** box and click **Install**. ![Accept the Azure AD Password Protection DC Agent license agreement](https://adamtheautomator.com/wp-content/uploads/2022/02/image-289.png) Accept the Azure AD Password Protection DC Agent license agreement 4\. Wait for the installation to complete and click **Finish**. ![Completing the Azure AD Password Protection DC Agent setup](https://adamtheautomator.com/wp-content/uploads/2022/02/image-290.png) Completing the Azure AD Password Protection DC Agent setup 5\. The Azure AD Password Protection DC Agent setup requires restarting the server. Click **Yes** to confirm. ![Rebooting the domain controller](https://adamtheautomator.com/wp-content/uploads/2022/02/image-291.png) Rebooting the domain controller There are no further configuration requirements to the Azure AD Password Protection DC Agent. After the restart, the DC agent initiates the download of the Azure AD password policy and repeats it every hour after that. ## Configuring the Azure AD Password Protection Settings in the Azure Portal After installing and configuring the Azure AD Password Protection on your on-prem servers, the next step is to configure the password protection settings in Azure AD. By default, the Azure AD Password Protection is in Audit mode — which does not enforce the banned passwords list. To enable and configure Azure AD Password Protection, proceed as follows. 1\. Log in to the [**Azure Active Directory admin center**](https://aad.portal.azure.com/). 2\. Next, click **Azure Active Directory —> Security —> Authentication methods —> Password protection**. ![Opening the Azure AD Password protection settings](https://adamtheautomator.com/wp-content/uploads/2022/02/image-292.png) Opening the Azure AD Password protection settings 3\. Leave the **Lockout Threshold** value to its default. This setting defines how many failed attempts a user had before locking out their account. Leave the **Lockout duration in seconds** to its default. This value defines the initial lockout duration before the user can attempt another login. ![Custom lockout settings](https://adamtheautomator.com/wp-content/uploads/2022/02/image-293.png) Custom lockout settings 4\. Under the **Custom banned passwords** section, set the **Enforce custom list** to **Yes**. Enter one or more custom passwords you want to ban inside the Custom banned password list box. > _The custom banned password list can contain up to 1000 entries, is case-insensitive, and automatically considers common character substitutions (i.e., “`p@ssw0rd`” is also “`password`”)._ ![Configuring the custom banned password list](https://adamtheautomator.com/wp-content/uploads/2022/02/image-294.png) Configuring the custom banned password list 5\. Under the **Password protection for Windows Server Active Directory** section, set the **Enable password protection on Windows Server Active Directory** to **Yes** and the **Mode** to **Enforced**. ![Enabling the Password protection for on-prem AD](https://adamtheautomator.com/wp-content/uploads/2022/02/image-295.png) Enabling the Password protection for on-prem AD 6\. Lastly, click **Save** at the top of the page to save the changes. ![Saving the password protection settings](https://adamtheautomator.com/wp-content/uploads/2022/02/image-296.png) Saving the password protection settings ## Checking the Azure AD Password Protection Status The new password protection configuration takes effect almost immediately in Azure AD. But in the case of your on-premises AD, the new configuration may take a minimum of an hour. This delay is due to the DC agent’s regular update interval of one hour. Follow these steps to confirm and force the Azure AD Password Protection policy enforcement. 1\. Retrieve the latest event ID `30006` on the DC to confirm the Azure AD password protection policy status. ```powershell Get-WinEvent -LogName 'Microsoft-AzureADPasswordProtection-DCAgent/Admin' | Where-Object {$_.Id -eq 30006} | Select -First 1 | Format-List ``` The result below shows that the Azure AD password policy status is enabled (Enabled: 1) but still only in audit mode (AuditOnly: 1). ![Confirming the Azure AD Password protection policy status](https://adamtheautomator.com/wp-content/uploads/2022/02/image-297.png) Confirming the Azure AD Password protection policy status 2\. To force the Azure AD password protection policy update, restart the `AzureADPasswordProtectionDCAgent` service on the domain controller. This step will reload the DC agent filters and submit a request to download the latest Azure AD password policy via the proxy service. ```powershell Restart-Service AzureADPasswordProtectionDCAgent ``` 3\. After restarting the `AzureADPasswordProtectionDCAgent` service, re-run the event lookup command in step 1. This time, you should see the value `AuditOnly: 0`, which means that the Azure AD password protection policy mode is now `Enforced`. ![Azure AD Password protection policy is Enforced](https://adamtheautomator.com/wp-content/uploads/2022/02/image-298.png) Azure AD Password protection policy is Enforced ## Testing the Azure AD Password Protection Policy Now it is time to test the Azure AD Password protection to confirm that everything you did so far works. And there are two ways you can test and simulate the user experience when changing passwords. ### Testing Password Change via Windows 1\. Initiate a password change on your domain-joined Windows computer by pressing `CTRL+ALT+DEL` (or `CTRL+ALT+END` if you’re on an RDP session) and clicking **Change Password**. ![Initiating a password change](https://adamtheautomator.com/wp-content/uploads/2022/02/image-299.png) Initiating a password change 2\. Type in your old password and the new password. The new password should be the banned password you added to the password policy. In this example, the password is `M@dumbpwd887`. ![Changing a password](https://adamtheautomator.com/wp-content/uploads/2022/02/image-300.png) Changing a password 3\. As a result, you should receive a message saying, _“Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain.”_ ![Unable to change the password](https://adamtheautomator.com/wp-content/uploads/2022/02/image-301.png) Unable to change the password ### Testing Password Change via Azure AD Open a browser, navigate to the [Azure AD change password](https://login.microsoftonline.com/) page, and sign with the current username and password. ![Signing in to Azure AD](https://adamtheautomator.com/wp-content/uploads/2022/02/image-302.png) Signing in to Azure AD On the **Change password** form, type the old password inside the **Old password** box. Next, type the new password in the **Create new password** and **Confirm new password** boxes, and click on **Submit**. ![Submitting a password change](https://adamtheautomator.com/wp-content/uploads/2022/02/image-303.png) Submitting a password change And because you entered a banned password as the new password, you will get the error message that says, _“Unfortunately, you can’t use that password because it contains words or characters that have been blocked by your administrator. Please try again with a different password.”_ ![Password change error](https://adamtheautomator.com/wp-content/uploads/2022/02/image-304.png) Password change error ## Securing Passwords with Specops Password Policy Implementing Azure AD Password Protection to your on-premises Active Directory domains is a significant step to increasing password security. But, a closer look would reveal that it falls short on some key features and has limited customization options. ### User Experience For example, changing to a banned password returns a generic message like the one below. Users would not know exactly why their attempts at changing their passwords fail. There’s no way for administrators to customize the message. This scenario potentially leads to more service desk calls. > _“Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain.”_ On the other hand, [Specops Password Policy](https://specopssoft.com/product/specops-password-policy/?utm_source=ata&utm_medium=referral&utm_campaign=na_2022_ata&utm_content=post) (SPP) significantly improves user experience. Users see the dynamic evaluation of the password against the existing policy. This way, users understand what they need to submit a compliant password successfully. No more guessing. ![Specops Password Policy password changes](https://adamtheautomator.com/wp-content/uploads/2022/02/image-305.png) Specops Password Policy password changes ### Extensive Breached Password List Regulatory and industry-standard recommendations like those from [NIST](https://pages.nist.gov/800-63-3/sp800-63-3.html) and [NCSC](https://www.ncsc.gov.uk/blog-post/passwords-passwords-everywhere) include using breached or known compromised password lists. Microsoft’s banned password list does not use such lists with Azure AD Password Protection. Specops Password Policy provides access to a collection of over two billion compromised passwords and those found in real password attacks. ### Custom Banned Password List Microsoft’s custom banned password list has a 1000 entry limit. Perhaps this limit is more than enough for some organizations, but larger organizations can quickly reach this limit. Moreover, each entry is limited to a minimum of 4 characters long. Specops Password Policy’s custom dictionary has no arbitrary limit on the number of entries you can add and with any length. Your banned password list may grow over the years at any rate and you wouldn’t worry about making way for more. ## Conclusion Azure AD Password Protection eliminates the use of weak passwords in your organization. But the lack of customization options and ignoring industry-standard and third-party breached password lists can be an issue and contribute to more password incident response efforts along the way. In contrast, Specops Password Policy solves these issues and offers more benefits than Azure AD Password Protection has. Once you implement SPP, you can effectively replace Azure AD Password Protection and let SPP secure passwords on your on-prem or hybrid Azure AD environment. Related:[Related: How to Secure Passwords with Specops Password Policy](https://adamtheautomator.com/specops-password-policy/) Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fazure-ad-password-policy%2F&text=How%20to%20Protect%20Passwords%20with%20an%20Azure%20AD%20Password%20Policy)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fazure-ad-password-policy%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fazure-ad-password-policy%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/08/featured_image-3.webp) ### [Build an Azure Home Lab for Certs Without Overspending](/azure-home-lab-certification-practice/) Build a nested Azure Hyper-V home lab with budget alerts, a domain controller, and Azure Arc mapped to AZ-900, AZ-104, and AZ-305 exams. ![](https://adamtheautomator.com/wp-content/uploads/2026/04/featured_image-20.webp) ### [How to Secure Azure Service Accounts with Managed Identities](/secure-azure-managed-identities/) Learn how to replace secret-based Azure service accounts with managed identities, grant least-privilege Azure RBAC access, validate token-based authentication, ![](https://adamtheautomator.com/wp-content/uploads/2026/04/featured_image-8.webp) ### [Avoid Entra ID Lockouts: Migrate Legacy MFA Policies](/avoid-entra-id-lockouts-migrate-legacy-mfa/) Learn how to migrate legacy MFA and SSPR policies to the unified Entra ID Authentication Methods policy, including audit, NPS extension fixes, and validation. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)