O365 password oddity

[Jawloms]

I am unable to reset users passwords in the same way as I always have done. If a student forgets their password, we reset it in the admin center to the same thing we always do and then get them to log in while we are with them so they an choose a new one. I'm now getting "Error resetting password" when I try to set it to what we've always used. If I choose something different it works. Did MS change something?

 

Thank you

 

Stuart

[themightymrp]

We are now getting the same, I think there must be a fault? Only started this morning

[robyholmes]

Could it be Azure Password Protection seeing your password as too generic/common?

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-password-protection-is-now-generally-available/ba-p/377487

[themightymrp]

@robyholmes - amazingly, this worked! We tend to reset student passwords to a generic one and get them to change it at their next logon. It would appear that starting yesterday, this generic password is deemed too frequently used! It must be that as the complexity still shows as 'strong'

 

Thanks for this

[robyholmes]

@robyholmes - amazingly, this worked! We tend to reset student passwords to a generic one and get them to change it at their next logon. It would appear that starting yesterday, this generic password is deemed too frequently used! It must be that as the complexity still shows as 'strong'

 

Thanks for this

 

No problem, I've moved to using this for onsite AD as we sync AD with Office 365. It's very odd sometimes what passwords it blocks so I've gone to using random passwords now rather than trying to create temporary ones for first logins or guests to use. It meant we could get rid of the requirement for a complex password which a number of our students (And some staff) struggled with.

[browolf]

there's also now a global secret dynamic banned wordlist that blocks passwords containing these words

 

Global banned password list

The Azure AD Identity Protection team constantly analyzes Azure AD security telemetry data looking for commonly used weak or compromised passwords. Specifically, the analysis looks for base terms that often are used as the basis for weak passwords. When weak terms are found, they're added to the global banned password list. The contents of the global banned password list aren't based on any external data source, but on the results of Azure AD security telemetry and analysis.

 

When a password is changed or reset for any user in an Azure AD tenant, the current version of the global banned password list is used to validate the strength of the password. This validation check results in stronger passwords for all Azure AD customers.

 

The global banned password list is automatically applied to all users in an Azure AD tenant. There's nothing to enable or configure, and can't be disabled. This global banned password list is applied to users when they change or reset their own password through Azure AD.

 

It seems to apply when creating accounts too.

 

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad

 

This ruins our new year7 password policy we just changed to make it easier for them to remember : digit capital adjective animal

Edited October 6, 2021 by browolf

[Oaktech]

All of mine are created using: somegreeting@sixdigitdate obviously the date is different each time so it seems to bypass this issue.