Implementing Azure AD Password Protection
Many identity systems rely on password complexity requirements to protect against password-related attacks such as password guessing and brute force. While this can provide a level of protection by forcing users to select passwords that are difficult to crack, it can also give a false sense of security. The reason for this is that there are passwords that users can select that may satisfy password complexity requirements but can still be easily guessed by attackers.
Take a password such as Pa$$w0rd1, for example. This password meets most complexity requirements (nine characters; includes uppercase and lowercase characters; includes special characters; includes digits). However, it is a common password that attackers are aware of, and this makes accounts that use it vulnerable to password spray attacks. The mitigation, in this case, is to ensure that your users cannot choose weak and vulnerable passwords like this even if they meet the required...
