Fourth Coffee's IT team has noticed that employees frequently set passwords like 'FourthCoffee2024!' and '4thCoffee#1' — variations of the company name that technically pass complexity rules but are easily guessable. The security team wants to proactively block these company-specific password patterns for all users. What should the admin configure to address this?
Select an answer to reveal the explanation.
Short Explanation
Think of the custom banned password list like a bouncer with a VIP blacklist — it blocks the words your org cares about that Microsoft's global list doesn't know about. You add company names, product names, or local slang, and Entra ID rejects passwords containing those strings, even with numbers or symbols swapped in.
Full Explanation
Microsoft Entra ID Password Protection includes two layers of banned password enforcement: a Microsoft-managed global banned password list (updated continuously based on real-world attack data) and a customer-managed custom banned password list. The custom list is configured under Microsoft Entra admin center > Protection > Authentication methods > Password protection. Admins enter custom terms (e.g., 'fourthcoffee', '4thcoffee'), and the engine evaluates passwords using fuzzy matching — so 'F0urthC0ffee2024!' would still be blocked even with character substitutions.
The Conditional Access policy that enforces password complexity requirements and blocks sign-ins from users who haven't updated their passwords recently is incorrect because Conditional Access policies govern access decisions (allow, block, require multi-factor authentication) based on signals like location, device compliance, or risk level. They do not evaluate or enforce password content. There is no Conditional Access policy action that blocks specific password strings.
The Self-Service Password Reset configuration that forces all users to perform an immediate password reset and select a password that does not match their previous ten passwords is incorrect because Self-Service Password Reset is a mechanism for users to reset their own passwords without contacting IT. Forcing a password reset through Self-Service Password Reset does not prevent users from choosing another variation of a banned word. The root problem — no enforcement against company-name passwords — remains unsolved.
The Azure AD Smart Lockout configuration that lowers the lockout threshold to 3 failed attempts so that accounts using weak passwords are locked out more quickly is incorrect because Smart Lockout is designed to protect accounts against brute-force and password spray attacks by temporarily locking accounts after repeated failed sign-in attempts. It has no awareness of what the password string itself contains; it acts after authentication attempts fail, not at password-creation time.
Exam tip: Password Protection with a custom banned list is the only mechanism in Microsoft Entra that enforces restrictions on password content at set/change time. Questions about blocking specific words or company-name patterns in passwords almost always point to this feature.