AzurePasswordProtectionCalculator

Calculator for Azure Password Protection. The calculation for what passes as a valid password is difficult to comprehend so I attempted to make a calculator.

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad

There are notably a few issues:

• the azure in-built password list is hidden. UPDATE: List was dumped and now been included in the tool!
• not all string substitions are given on the documentation
• SSPR can bypass reuse of old password, something I cannot account for
• License Requirement of P1 / P2
• Tenant name matching isn't done when validating passwords on an AD DS domain

Score Calculation

Fuzzy Matching Behaviour

Normalization

Password Requirements

Ref https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy#microsoft-entra-password-policies

Example

Audit

KQL

AuditLogs
| where OperationName == "Change password (self-service)"
| where ResultDescription == "PasswordDoesnotComplyFuzzyPolicy"
| extend User = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| summarize count() by User
| where count_ > 1

Featured on Entra News Issue 26 https://entra.news/p/entranews-26-your-weekly-dose-of