Azure AD Password protection with on premise Domain password policy

Question

Hello,

I have a question on Azure AD Password Protection. If I install it on all DC of a domain, will the user password change continue to meet the local domain password policy ?
How the password will be validated ? (GPO verification--> Azure Password protection validation, Azure Password Protection validation --> GPO verification ?)

Thank you in advance for your help :)

Answer 1

Hi,

Yes, passwords will need to meet domain requirements as well as Azure AD Password Protection, assuming you have Passwords must meet complexity requirements Enabled. And if you have any other password filter dlls (besides AAD Password Protection), the passwords would need to be acceptable to those as well.

All of the password filters installed on the system must return true for a password to be accepted.

Some references if you would like to learn more:

https://learn.microsoft.com/en-us/windows/win32/secmgmt/strong-password-enforcement-and-passfilt-dll

https://learn.microsoft.com/en-us/windows/win32/api/ntsecapi/nc-ntsecapi-psam_password_filter_routine

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-faq#is-it-supported-to-install-azure-ad-password-protection-side-by-side-with-other-password-filter-based-products

-TP