Lastly, I want to show you where to find Azure AD Password Protection in
the Azure portal because it's kind of tucked off to the side, it's a bit
difficult to find. So, in the Azure portal, you want to go to your Azure
Active Directory tenant, and then in the Settings, you'll want to come down
to Security down here. The Security blade loads up, and then you'll want to
go to Authentication methods under Manage, and then lastly, we have, under
Manage,
we have Password Protection, and this ultimately gets you to where I showed
you in the screenshot where you've got your custom password list and then
whether you want to enable Azure AD Password Protection for local AD. And
Microsoft's official guidance is to start in audit mode, so you don't
create a denial of service, just track and see what happens. That will tell you,
for example, if a local or Azure AD password change would have
failed validation or not, and you can see and track that down and
maybe talk with the user or whatever.
Oh,
I almost forgot. If I go back to the Group Policy Management console and
we take a look at our custom policy that we created, and we linked to the
domain workstation's OU, we can select the GPO, go to Details, and this
is where you can configure that selective disablement that I told you
about, where by default,
both the Computer Configuration and User Configuration Settings
are enabled. But notice that we can choose,
for example, User Configuration settings disabled to disable those and just have the Computer Configuration applied in that GPO.