Let me turn off the account lockout policy here and click OK.
I just want to keep that at the password level. So there is our
Password Settings object, pretty easy to do.
It's been a mature technology in Windows Server for a long time.
Lastly, let's turn our attention to Azure AD Password Protection.
This, of course, is going to require that you have an Azure subscription.
So, what we can do,
let me actually start at the beginning. In the Azure portal,
portal.azure.com, you can browse to your Azure Active Directory tenant.
You can easily find it just by searching Active Directory.
I have it here in my Recent services list.
Unfortunately,
Azure AD Password Protection is kind of hidden in the Azure AD interface.
What we want to do here is go down to Security, right here, and then in
the Security blade we want to go to, let's see, see,
I'm still stuck, there we go, Authentication methods, and
then lastly we have Password protection.
Now, I want you to understand that unfortunately there is not an
indication that there's more work to be done. Specifically, we want to
protect our on‑premises Active Directory Domain Services domain, and you
can see right down at the bottom we have Password protection for Windows
Server Active Directory.
Yes,
you notice that I switched that from No to Yes. And then for your enforcement
mode you can perhaps start with Audit and then check the Azure Active
Directory audit logs to see how it's behaving when users change their
passwords, or if you're ready to enforce those rules,
you can flip it there and then save your change. Now,
like I said,
there's more to this. Let me actually come over here. You're going to need to
download and install the Azure AD Password Protection agents and install those
on at least two servers in your local environment.
Now, again, no VPN, no ExpressRoute required.
You can come to this Microsoft Download Center page just by doing a
Google search like I did for Azure AD Password Protection agents. And
it's a free download, and as you'll see,
there's a separate installer for the proxy and the domain controller agent.
Now you'll probably want to install this service on redundant servers for high
availability, but remember what I said earlier, that the DC,
the domain controller agent, is what installs that filter DLL,
but the actual connectivity between Azure and on‑prem has to be
on a member server, and that's the purpose of the Azure AD
Password Protection proxy setup.
So don't forget about that step.
They communicate right over the internet.
And then lastly,
you can configure the Azure AD Password Protection service here back
in the portal by doing things like these are some account lockout
settings here that are similar to the ones that we might have
configured in our Group Policy object.
And then as I told you earlier,
there's the Microsoft‑curated banned passwords list that you don't get to see
and then there's the custom list which you do get to create.
And as you can see here,
my fictional company Contoso is located in Nashville, Tennessee, and
let's say our main line of business app is called lobapp.
We've got timwinfo, so these are administrator‑created banned passwords, and
this is going to ideally improve the password strength of your users because
they won't be able to include any variation of these strings in their
passwords when they change their passwords.
Again, as I said,
Microsoft is smart enough in their algorithm to do simple
substitution, so you don't have to worry about Contoso
with an upper and lowercase,
you can just specify one and Password Protection would apply the same
protection, that is it would deny the password change if a user tried
to use part or all of the string contoso with a lowercase c or some
other casing. You see what I mean?
So, again,
pretty straightforward here at this point, and that is Azure AD Password Protection in a nutshell.