Passwords remain the first line of defense against cyber threats, but attackers have become experts at exploiting weak or predictable choices. Attackers increasingly collect huge numbers of known passwords, including “informed guesses” based on password breaches or even leaked personally-identifiable information. Password spray and password stuffing attacks where massive numbers of plausible passwords are being attempted in a short period of time are now responsible for the vast majority of identity breaches, according to Microsoft’s latest research. [expertinsights.com]

For years, organizations have relied on password length and complexity rules, which required a mix of letters, numbers, and symbols, alongside frequent password changes. However, many common and vulnerable passwords (for instance, Password1234! or Winter2026#) are difficult to completely restrict using traditional tools since they meet those legacy requirements despite clearly being insecure.

Password change requirements are unhelpful since even a short password age window would not obstruct a successful breach for weeks to months in most cases.

Clearly, what’s needed is a smarter, more proactive approach—one that blocks unsafe passwords before they can be used, even if they look “complex” on the surface.

What Is Entra ID Password Protection?

Microsoft Entra ID Password Protection is a modern security feature that automatically checks every new password against Microsoft’s global list of commonly attacked passwords, as well as custom lists tailored to your organization. If a password is found on these lists—or is a close variant—it’s rejected, prompting the user to choose something stronger. This applies whether users are logging in to cloud-based systems or, for clients using Entra ID Connect, when passwords are synchronized from on-premises Active Directory. [learn.microsoft.com] [petri.com]

Key benefits:

• Blocks unsafe passwords—even those that meet complexity rules.
• Protects against password spray and brute-force attacks.
• Works automatically for cloud logins; now extended to on-premises environments for all applicable clients.

How Does This Protect Your Organization?

With Entra ID Password Protection enabled, users can no longer set passwords that are known to be frequently attacked—even if those passwords technically meet length or complexity requirements. For example, “Password1234!” or “Winter2026#” would be rejected, forcing users to choose something truly unique and secure. [learn.microsoft.com]

This approach dramatically reduces the risk of unauthorized access due to weak or reused passwords. It also helps organizations comply with modern security standards and best practices, without relying solely on user education or routine password changes.

Included as Part of Our Commitment to Smart, Secure Working

Entra ID Password Protection is built-in to Microsoft 365 and included at no additional cost; however, by default this only covers password changes where the user account is cloud-only. Significant additional deployment and configuration to add these security features for companies where users are synchronized from on-premises systems using Entra ID Connect. 

For all of our managed servcies clients, GreenLoop has now enabled Entra ID Password Protection across both cloud and on-premises environments. This means that every password change—whether performed in the cloud or on-premises—is checked against Microsoft’s banned password lists. This ensures consistent, enterprise-grade protection for all users, everywhere they log in. [petri.com]

We’re proud to offer this enhanced protection to all eligible clients at no additional fee, as part of our ongoing commitment to integrity and smart working. By proactively managing your information security strategy, we help ensure that your organization’s digital assets remain safe, resilient, and ready for whatever comes next.

What’s Next?

No action is required on your part—If your organization uses Microsoft 365, Entra ID Password Protection is already enabled for your 365 accounts going foward. If you have questions about how this works, or want to learn more about additional security features, our team is here to help.

Ready to take the next step in password security?
Contact your account manager for more details, or visit Microsoft’s official documentation. [learn.microsoft.com]