Microsoft Entra ID policies should have 'Custom banned password list' set to 'Enforce'
Microsoft Azure applies a default global banned password list to all user and admin accounts that are created and managed directly in Microsoft Entra ID. This control checks that the `Custom banned password list` setting is set to `Enforce`.
What this control checks
Passes if Custom banned password list is set to Enforce in Entra ID; fails otherwise
Common pitfalls
Policy does not apply to synced on-premises users
The Microsoft Entra password policy does not apply to user accounts that are synchronized from an on-premises Active Directory environment, unless Microsoft Entra ID Connect is used and EnforceCloudPasswordPolicyForPasswordSyncedUsers is enabled.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.ad_custom_banned_password_enforced.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 5.8 (Ensure that a 'Custom banned password list' is set to 'Enforce').
Framework mappings
The clauses this control is mapped to in each framework.
- 5.8 Ensure that a 'Custom banned password list' is set to 'Enforce'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_custom_banned_password_enforced - Powerpipe Control:
azure_compliance.control.ad_custom_banned_password_enforced
Last reviewed: 2026-10-09