How does the password policy work in Hybrid environments?

Question

My understanding is that there's a enforced default password policy on Azure AD, Office365 etc..

If password complexity requirements aren't set on the on prem AD does that mean weak passwords can sync back into our Azure AD/Office365?

Answer 1

The Azure AD Password policies apply ONLY to the cloud-based accounts unless you have set the correct configuration
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy#password-policies-that-only-apply-to-cloud-user-accounts

Otherwise, the on-prem password policies apply to the synced accounts.
You should enable password writeback and SSPR to ensure this:
https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks

as well as Password Hash Sync:
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs