Azure AD (Cloud Only) PCI 8.2.5 Compliance?

Question

Hi there. For my company i'm using Azure AD (Cloud Only) for users access control. PCI 8.2.5 says that i have to control that users can not user their last 4 passwords, but i see that Azure AD (cloud only) just prevent using the last password, not the 4 before.

In addition to that, when i check the Microsoft PCI AOC it says that this product is PCI compliance, so i do not understand that limitation (configurable password history policy) in the product (Azure AD)

This means that i could be PCI Not Compliance because of this Azure AD limitation.

Do you know if there is other way i can be compliance about PCI 8.2.5? or any compensatory control?

Tnks!

Answer 1

Hey @Andres Felipe Mejia Sanchez

Unfortunately the documented password policy limits are to remember the last password only.

There is a uservoice suggestion for this item here.

For your options to implement other controls, you could do the following. Make sure to discuss with your PCI compliance experts first ;)

• Implement Sync from an on-premise directory - Apply your policies within Active Directory
• Federate with an identity provider which enables password controls - Apply policies within the external IDP
• Go Password-less

Personally, I would suggest going password-less - I use a yubikey & windows hello for all my sign-ins and the experience is great.