CreativeTechsBaseline
tenant security posture
CTB-07 · Tier 1 · Silent · M365

Entra Password Protection with a custom banned list

EIDSCA PR01–PR05Huntress 3 password controls · Medium2 authorities
0
Tenants failing
0
Tenants meeting
0
Measured
REQUIRED
Disposition
The settingWhat we hold this to
CreativeTechs minimum
Password protection mode = Enforce. Enforce custom list = true, with at least 10 client-specific terms (company name, product names, town, local teams). Smart lockout threshold ≤ 10, lockout duration ≥ 60 seconds. On-prem enforcement = true where a DC exists.
Benchmark position
EIDSCA.PR01 mode 'Enforce'; PR03 custom list 'True'; PR05 lockout duration recommended 60 seconds; PR02 on-prem enforcement 'True'. Our 60s floor is exactly the EIDSCA figure.
Where we differ, and why
EIDSCA publishes no threshold figure; the ≤10 attempts floor is ours.
Where the switch is
Entra admin centre → Protection → Authentication methods → Password protection.
https://entra.microsoft.com
How to verify
Graph: /beta/settings  →  values where name in ('BannedPasswordCheckOnPremisesMode','EnableBannedPasswordCheck','EnableBannedPasswordCheckOnPremises','LockoutDurationInSeconds','LockoutThreshold')
Across the fleet
Client
State
Evidence
Blackwing
UNKNOWN
No Secure Score evidence — awaiting Maester.
BravicaOne
UNKNOWN
No Secure Score evidence — awaiting Maester.
CMG Law
UNKNOWN
No Secure Score evidence — awaiting Maester.
CreativeTechs
UNKNOWN
No Secure Score evidence — awaiting Maester.
DCG One
UNKNOWN
No Secure Score evidence — awaiting Maester.
Diversified Management Services
UNKNOWN
No Secure Score evidence — awaiting Maester.
Double Z
UNKNOWN
No Secure Score evidence — awaiting Maester.
Electric Pen
UNKNOWN
No Secure Score evidence — awaiting Maester.
Graphiti Associates
UNKNOWN
No Secure Score evidence — awaiting Maester.
Guidance Engineering
UNKNOWN
No Secure Score evidence — awaiting Maester.
India Tree
UNKNOWN
No Secure Score evidence — awaiting Maester.
MIR Corp
UNKNOWN
No Secure Score evidence — awaiting Maester.
Phinney Bischoff
UNKNOWN
No Secure Score evidence — awaiting Maester.
Quiver Dental
UNKNOWN
No Secure Score evidence — awaiting Maester.
RHO Architects
UNKNOWN
No Secure Score evidence — awaiting Maester.
Retail Voodoo
UNKNOWN
No Secure Score evidence — awaiting Maester.
Riverstone
UNKNOWN
No Secure Score evidence — awaiting Maester.
SSF
UNKNOWN
No Secure Score evidence — awaiting Maester.
Slingshot Architecture
UNKNOWN
No Secure Score evidence — awaiting Maester.
Stoke
UNKNOWN
No Secure Score evidence — awaiting Maester.
Turnstyle
UNKNOWN
No Secure Score evidence — awaiting Maester.
Urban Animal
UNKNOWN
No Secure Score evidence — awaiting Maester.
WLIHA
UNKNOWN
No Secure Score evidence — awaiting Maester.
Zak Designs
UNKNOWN
No Secure Score evidence — awaiting Maester.
Why it matters
Blocks the passwords that actually get sprayed. The custom list carries the client's own name, town, teams and product names — what a targeted spray tries first.
How we check
Maester EIDSCA.PR01, PR02, PR03, PR05.
Fix — M365
Entra → Authentication methods → Password protection → custom list = Yes, mode = Enforced, lockout threshold and duration set. Populate per client.
Fix — Google
Admin → Security → Password management → length and reuse rules.
User notices
None until someone tries a banned password at next change.
Expected pushback
None. Four settings on one screen, currently at Microsoft's permissive defaults on our own tenant.