Skip to content
MitoMito Docs

EIDSCA.PR01: Default Settings - Password Rule Settings - Password Protection - Mode.
ID EIDSCA.PR01
Severity High
Suite EIDSCA
Product Entra ID
Related products Active Directory
Feature Password protection
Security area Authentication
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:IA-5(1) Authenticator Management | Password-based Authentication
MITRE ATT&CK T1110
Reads from Microsoft Graph
Licence needed AAD_PREMIUM

What this checks and how to fix it

Section titled “What this checks and how to fix it”

If set to Enforce, users will be prevented from setting banned passwords and the attempt will be logged. If set to Audit, the attempt will only be logged.

Microsoft Entra Password Protection - Microsoft Entra ID - Microsoft Learn

Test script

Section titled “Test script”
https://graph.microsoft.com/beta/settings
.values -eq 'Enforce'
Section titled “Related links”

MITRE ATT&CK

Section titled “MITRE ATT&CK”
mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0006 - Credential Access - Credential Access
    (Mitigation)
      M1018 - User Account Management
      M1027 - Password Policies
    (Technique)
      T1110 - Brute Force
Tactic Technique Mitigation
TA0006 - Credential Access - Credential Access T1110 - Brute Force M1018 - User Account Management
M1027 - Password Policies

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.