Back to Checks
m365

Entra password protection is enforced on on-premises Active Directory

entra_password_protection_on_premises_enforced
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

The tenant Password Rule Settings should enable password protection on Windows Server Active Directory (EnableBannedPasswordCheckOnPremises) with the mode set to Enforced. This extends Entra banned-password checks to on-premises password changes in hybrid environments. This control only applies to tenants with on-premises directory synchronization.

Prowler logoProwlerprowler-provider-m365

Risk

Without on-premises enforcement, users in hybrid environments can set weak or banned passwords directly in Active Directory, bypassing Entra password protection and weakening the organization's overall password posture.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_password_protection_on_premises_enforced

Recommendation

Enable on-premises Entra password protection in Enforced mode and deploy the password protection proxy and DC agents so banned-password rules apply to on-premises password changes.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Protection** > **Authentication methods** > **Password protection**
3Set **Enable password protection on Windows Server Active Directory** to **Yes**
4Set **Mode** to **Enforced**
5Click **Save** (requires the Entra Password Protection agents deployed on-premises)

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import (
    PASSWORD_RULE_SETTINGS_TEMPLATE_ID,
)


class entra_password_protection_on_premises_enforced(Check):
    """Check if Entra password protection is enforced on on-premises Active Directory.

    The Password Rule Settings directory setting should enable password protection on
    Windows Server Active Directory (EnableBannedPasswordCheckOnPremises) with the
    mode set to Enforced, so banned-password rules apply to hybrid on-premises
    password changes.

    This check applies only to hybrid tenants with on-premises synchronization.

    - PASS: On-premises password protection is enabled and set to Enforced.
    - FAIL: On-premises password protection is disabled or set to Audit only.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the on-premises password protection enforcement check.

        Evaluate whether the Password Rule Settings directory setting enables and
        enforces banned-password protection for on-premises Active Directory. When the
        settings object is absent or the tenant is confirmed cloud-only, no finding is
        produced.

        Returns:
            List[CheckReportM365]: A list with a single report when the Password Rule
            Settings exist for a hybrid or unknown tenant, or an empty list when they
            are absent or the tenant is confirmed cloud-only.
        """
        findings = []
        organizations = entra_client.organizations or []
        if organizations and not any(
            organization.on_premises_sync_enabled for organization in organizations
        ):
            return findings

        settings = entra_client.directory_settings.get(
            PASSWORD_RULE_SETTINGS_TEMPLATE_ID
        )
        if not settings:
            return findings

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=settings or {},
            resource_name="Password Rule Settings",
            resource_id=PASSWORD_RULE_SETTINGS_TEMPLATE_ID,
        )
        report.status = "FAIL"
        report.status_extended = (
            "On-premises password protection is not enforced in the tenant."
        )

        if settings:
            enabled = (
                str(settings.get("EnableBannedPasswordCheckOnPremises", "")).lower()
                == "true"
            )
            mode = str(settings.get("BannedPasswordCheckOnPremisesMode", "")).lower()
            if enabled and mode == "enforced":
                report.status = "PASS"
                report.status_extended = (
                    "On-premises password protection is enabled and enforced in the "
                    "tenant."
                )

        findings.append(report)
        return findings

References