Going further, I had mentioned that a current trend or the current
trend with passwords is to have fewer password changes, but better
password choice by your user. We can implement Azure AD Password
Protection to protect our on‑premises users and ensure that they
are doing just that.
In other words, choosing a strong password.
Azure AD Password Protection is a cloud service that
prevents password changes to weak passwords.
How do you identify a weak password?
Well, you know that in Group Policy you can do your basic complexity,
uppercase, lowercase, alphanumeric, non‑alphanumeric kind of thing.
But I'm talking about a somewhat different approach where you've
got those baseline properties, but Azure AD Password Protection is
based on the banned password list.
Now, there's a global list that Microsoft curates, and they do not publish that
because they don't want to give any hints to malicious entities, and then
there's custom lists that are administrator‑defined.
So the long story short with password protection is you
can add to your own custom list. Let's say that you're a
business that makes widgets.
You've got widget A, widget B, widget C. And by adding those keywords to
your custom list, that would prevent a user from creating a password that
includes any of those keywords. You know,
because the idea is that any well‑known string value is going to be probably
among the first tries a malicious entity will use if they're attempting to
breach an account. And we'll see this more in the demo, but Azure AD
Password Protection also can branch out.
So if you had a custom list with an entry of widget,
you don't have to think of all these alternate spellings of the word,
Password Protection can naturally branch out to cover variants.
Similarly,
it picks up traditional weak passwords. You know how every year various
tech companies publish the top weakest passwords in the world? Well, you
can rest assured that Azure AD Password Protection in the global list
already has those, including all variants,
including things like substituting a dollar sign for S.
What would be another one, common one, a 1 for an I,
all of that kind of stuff.
So users aren't going to be able to get away with that kind of
shenanigans when they change their password.
Now if your environment exists only in Azure,
Azure AD Password Protection is free to use.
However,
if you're hybrid cloud, you're going to need to ensure that any users
who are covered by Azure AD Password Protection have either an Azure
AD Premium P1 or P2 license. For the exam, we need to go a little bit
deeper on password protection.
So this is a topology diagram,
just a reference topo, that I created in Lucidchart. Let's start
at the left and work our way to the right. On the left side, we
have our Azure environment where an Azure administrator sets up
the password protection, the lists,
etc. Those are associated with your company's Azure Active
Directory tenant. Now, notice that we go over the internet between
Azure and your local on‑premises environment at right. There is not
a restriction or a limitation such that you need either a VPN or an
ExpressRoute circuit.
We're just going over the internet with TCP 443. Check the docs,
there may be a couple additional ports necessary.
It's always a good idea to check those docs.
I gave you the appropriate links in the exercise files. But the
main part I want you to see for the exam is, number one, when you
deploy Azure AD Password Protection,
you're going to need to deploy the client‑side service on two servers
at the very least. You're going to install the Password Protection
proxy service on a member server, and then there's a filter DLL that
will be on your domain controllers.
The way that Microsoft architected this is that you cannot have
the domain controller directly proxying requests from Azure. You
have to have a separation of duties.
So, like I said,
the communication between on‑prem domain and Azure AD is going to be
through that proxy that you have installed on one or more domain member
servers, and then the actual password processing takes place in conjunction
with the Azure AD Password Protection filter DLL and is replicated to other domain controllers using SYSVOL.