EIDSCA.PR01 - Default Settings - Password Rule Settings - Password Protection - Mode.
Overview
If set to Enforce, users will be prevented from setting banned passwords and the attempt will be logged. If set to Audit, the attempt will only be logged.
Microsoft Entra Password Protection - Microsoft Entra ID - Microsoft Learn
Test script
https://graph.microsoft.com/beta/settings
.values -eq 'Enforce'
Related links
- Open in Graph Explorer
- directorySetting resource type - Microsoft Graph beta | Microsoft Learn
- View in Microsoft Entra admin center
MITRE ATT&CK
| Tactic | Technique | Mitigation |
|---|---|---|
| TA0006 - Credential Access - Credential Access | T1110 - Brute Force | M1018 - User Account Management M1027 - Password Policies |
Test Metadata
| Field | Value |
|---|---|
| Test ID | EIDSCA.PR01 |
| Severity | High |
| Suite | Entra ID SCA |
| Product | Entra ID |
| Related products | Active Directory |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110 Brute Force |
| Supports controls | nist-800-53-r5:IA-5(1) |
| PowerShell test | Test-MtCheckEidscaPR01 |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/eidsca/Test.EIDSCA.PR01.ps1 - Documentation:
tests/eidsca/Test.EIDSCA.PR01.md