Entra on-premise password protection, without deploying Azure, hybrid environment

Question

We have an on prem AD, with one way AD sync to M365 on E3 level. We are looking for clarification to the following question, want to know if it is possible to deploy Entra on-premise password protection, without deploying Azure/Entra AD?

Answer 1

well, you are using Entra :)

If you want to use Entra password protection you need the correct license:

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad#license-requirements

Answer 2

Hi @300cPilot

Thank you for reaching out to the community forum!

To answer your question, Deploying Microsoft Entra on-premises password protection requires integration with Entra ID (Azure AD). Microsoft Entra Password Protection is an Azure feature that supports being extended into an on-premises Active Directory environment.

To protect your on-premises Active Directory Domain Services (AD DS) environment, you can install and configure Microsoft Entra Password Protection to work with your on-premises domain controller (DC)

Reference: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-faq#how-can-i-deploy-and-configure-microsoft-entra-password-protection-in-my-active-directory-environment-without-using-azure

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy

Hope this helps. Do let us know if you any further queries.

Thanks,

Akhilesh.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 3

@300cPilot Here is the link for deployment of Password protection - https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy A

As you asked above clarification on this statement "On-premises AD DS users that aren't synchronized to Microsoft Entra ID also benefit from Microsoft Entra Password Protection based on existing licensing for synchronized users" - as per my understanding is that the on prem users are covered by the existing licenses for the synced users.

Let me know if you have any questions, feel free to post back.