rules/findings/entra/identity_protection/eid-custom-banned-password-list-disabled.json
|
{
"provider": "EntraID", "serviceType": "Identity Protection", "serviceName": "Microsoft Entra ID", "displayName": "Ensure custom banned passwords lists are used", "description": "With Entra Password Protection, default global banned password lists are automatically applied to all users in an Entra ID tenant. To support business and security needs, custom banned password lists can be defined. When users change or reset their passwords, these banned password lists are checked to enforce the use of strong passwords.\n\t\tA custom banned password list should include some of the following examples: \n\t\t* Brand names \n\t\t* Product names \n\t\t* Locations, such as company headquarters \n\t\t* Company-specific internal terms \n\t\t* Abbreviations that have specific company meaning \n\t", "rationale": "Creating a new password can be difficult regardless of one\u0027s technical background. It is common to look around one\u0027s environment for suggestions when building a password, however, this may include picking words specific to the organization as inspiration for a password. An adversary may employ what is called a \u0027mangler\u0027 to create permutations of these specific words in an attempt to crack passwords or hashes making it easier to reach their goal.", "impact": "If a custom banned password list includes too many common dictionary words, or short words that are part of compound words, then perfectly secure passwords may be blocked. The organization should consider a balance between security and usability when creating a list.", "remediation": { "text": "###### To set a custom bad password list, use the Microsoft Entra ID blade\r\n\t\t\t\t\t1. In \u0060Microsoft Entra ID\u0060, click on \u0060Security\u0060.\r\n\t\t\t\t\t2. Under \u0060Management\u0060 select \u0060Authentication\u0060, then \u0060Password Protection\u0060.\r\n\t\t\t\t\t3. Set the \u0060Enforce custom list\u0060 to \u0060Yes\u0060.\r\n\t\t\t\t\t4. Double click the custom password list to add a string.\r\n\t\t\t\t\t5. Click \u0060Save\u0060.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad#custom-banned-password-list", "https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-configure-custom-password-protection" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "5.0.0", "reference": "5.2.3.2", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "aad_password_protection_policy", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "customBannedPasswords.Count", "eq", "0" ], [ "enforceCustomBannedPasswords", "eq", "false" ] ], "operator": "or" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": {}, "expandObject": null }, "table": null, "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": false, "showModalButton": false, "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": [], "message": "Custom Bad Password List is not set", "defaultMessage": null }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "aad_custom_bad_password_disabled", "notes": [], "categories": [], "immutableProperties": [], "id": "entraid_1152" } |