Back to Checks
m365

Entra custom banned password list is enforced

entra_password_protection_custom_banned_list_enforced
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

The tenant Password Rule Settings should enforce a custom banned password list (EnableBannedPasswordCheck true with a non-empty BannedPasswordList). This blocks organization-specific weak or predictable passwords (e.g., company name, products, locations) in addition to Microsoft's global banned list.

Prowler logoProwlerprowler-provider-m365

Risk

Without a custom banned password list, users can choose passwords that are predictable for the specific organization (brand names, local terms), which are easy targets for password spraying and guessing attacks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_password_protection_custom_banned_list_enforced

Recommendation

Enable the custom banned password list and populate it with terms relevant to the organization to strengthen protection against weak passwords beyond the global banned list.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Protection** > **Authentication methods** > **Password protection**
3Set **Enforce custom list** to **Yes**
4Add organization-specific terms to the **Custom banned password list**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import (
    PASSWORD_RULE_SETTINGS_TEMPLATE_ID,
)


class entra_password_protection_custom_banned_list_enforced(Check):
    """Check if the Entra custom banned password list is enforced.

    The Password Rule Settings directory setting should enforce a custom banned
    password list (EnableBannedPasswordCheck) with a non-empty BannedPasswordList so
    that organization-specific weak passwords are rejected in addition to the global
    banned list.

    - PASS: The custom banned password list is enforced and non-empty.
    - FAIL: The custom banned password list is not enforced or is empty.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the custom banned password list enforcement check.

        Evaluate whether the Password Rule Settings directory setting enforces a
        non-empty custom banned password list. When the settings object is absent,
        no finding is produced.

        Returns:
            List[CheckReportM365]: A list with a single report when the Password Rule
            Settings exist, or an empty list when they are absent.
        """
        findings = []
        settings = entra_client.directory_settings.get(
            PASSWORD_RULE_SETTINGS_TEMPLATE_ID
        )
        if not settings:
            return findings

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=settings or {},
            resource_name="Password Rule Settings",
            resource_id=PASSWORD_RULE_SETTINGS_TEMPLATE_ID,
        )
        report.status = "FAIL"
        report.status_extended = (
            "The custom banned password list is not enforced in the tenant."
        )

        if settings:
            enforced = (
                str(settings.get("EnableBannedPasswordCheck", "")).lower() == "true"
            )
            banned_list = settings.get("BannedPasswordList", "") or ""
            if enforced and banned_list.strip():
                report.status = "PASS"
                report.status_extended = (
                    "The custom banned password list is enforced in the tenant."
                )

        findings.append(report)
        return findings

References