Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID policies should have 'Custom banned password list' set to 'Enforce'
Microsoft Azure applies a default global banned password list to all user and admin accounts that are created and managed directly in Microsoft Entra ID. This control checks that the `Custom banned password list` setting is set to `Enforce`.
What this control checks
Passes if Custom banned password list is set to Enforce in Entra ID; fails otherwise
Framework mappings
The clauses this control is mapped to in each framework.
- 5.8 Ensure that a 'Custom banned password list' is set to 'Enforce'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_custom_banned_password_enforced - Powerpipe Control:
azure_compliance.control.ad_custom_banned_password_enforced
Last reviewed: 2026-10-09