3.2.3. Password Protection and Management
💡 First Principle: Even with MFA and passwordless options available, passwords remain in use across many systems, so Microsoft Entra ID includes capabilities that make the passwords that do exist harder to guess and easier for users to recover safely on their own — reducing both breach risk and help-desk burden at once.
Microsoft Entra Password Protection blocks known weak and commonly-breached passwords (a global banned password list, plus a custom list an organization can extend) at the moment a password is set or changed. Smart lockout differentiates genuine login attempts from malicious ones, locking out likely attackers faster while reducing false lockouts of real users who simply mistype. Self-service password reset (SSPR) lets users securely reset a forgotten password themselves — through verification methods like a mobile app or phone — without contacting the help desk.
⚠️ Exam Trap: Password protection blocks weak or breached passwords at creation time; it doesn't retroactively force a review of every existing password already in use unless combined with other policies.
Reflection Question: How does self-service password reset reduce security risk, rather than simply reducing help-desk ticket volume?
