3 ms·
Microsoft has a pwnedpasswords-like service you can use: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-pre
by technion 7y ago
Microsoft has a pwnedpasswords-like service you can use:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises https://docs.microsoft.com/en-us/azure/active-directory/auth...
- discreditable 7y ago* If you use Azure Active Directory
- funnybeam 7y agoOn-premises AD has the same functionality but it is a pain to set up and so limited as to be not worth the effort
- omh 7y agoI don't think this (Azure AD Password Protection) actually implements a pwnedpasswords-style check. It lets you upload your own custom list of banned passwords but it's limited to 1000 words. My impression is that this is intended to blacklist common words and things like your company name. I see that Troy Hunt is now working for Microsoft so perhaps there's something in the works related to this. It seems like linking this Azure AD service to the haveibeenpwned API would be pretty straightforward.