I don't think this (Azure AD Password Protection) actually implements a pwnedpasswords-style check. It lets you upload your own custom list of banned passwords

I don't think this (Azure AD Password Protection) actually implements a pwnedpasswords-style check. It lets you upload your own custom list of banned passwords but it's limited to 1000 words. My impression is that this is intended to blacklist common words and things like your company name. I see that Troy Hunt is now working for Microsoft so perhaps there's something in the works related to this. It seems like linking this Azure AD service to the haveibeenpwned API would be pretty straightforward.