Now,
what about a hybrid cloud scenario in which you're doing directory
synchronization from your local Active Directory Domain into Azure
AD? Azure AD has a really nifty feature called Password Protection,
and this, as you can see,
I know the screenshot is a bit small, allows you to do lockouts, that if an
account is locked out after a certain number of failed attempts,
there's a duration.
Again,
the idea with lockout is not to needlessly raise your support ticket volume
and give your support desk people more work to do, instead,
it's to prevent malicious people from trying to brute force and try millions
of password attempts to sign into one of your systems.
The idea is if they hit a lockout duration for every 10 failed sign‑ins,
that will be too much time and too much work and too much effort, and so
they will be discouraged and they'll move on.
That's the idea.
But the main thing about Password Protection,
if you turn it on in your Azure AD tenant, is you can develop what's
called a custom banned password list. Let's say that you make widgets as
part of your company and you've got different widget products. You don't
want any of your users' passwords, including any part of those names, or
your organization names, your department names,
you can develop the static list. And there's also a bunch of other logic
built in to where you can't try to fool around by using your company
name doing letter substitution, like an @ sign for a, or a $ for s; the
Password Protection in Azure AD is smart enough to recognize those kind
of variants. And again,
it's probably small on your screen, but there's a yes/no down
there at the bottom of this screenshot that says password
protection for Windows Server Active Directory that can either
run in audit or enforced mode.
And this means if you're doing directory synchronization,
you can extend your Password Protection to on‑premises. And I
say it assumes directory synchronization; you don't technically
need to be using Azure AD Connect,
but I'm presuming you're doing so if you are in a hybrid identity situation.
Long story short, to enable Azure AD Password Protection on‑prem,
it's going to involve installing some proxy services on two or more member
servers locally, and these are just going to communicate over the internet to
the Azure AD endpoints, called the Azure AD Password Protection Proxy, and
you want more than one of those, again,
for high availability. And on your domain controllers,
you'll install an agent password filter DLL, and then you've got
just with web services, whenever a user attempts a password change,
those passwords are going to be filtered against not only your
local Active Directory Password Policy and potentially fine‑grained
password policies,
but also your Azure AD Password Protection and custom banned password list.
And lastly,
those password policies are replicated via DFSR replication in the SYSVOL
folder. There's a couple different ways to configure SYSVOL replication, and
Azure AD Password Protection does require that you're using DFSR. Check the exercise files for some more guidance on that.