Skip to content
MitoMito Docs

EIDSCA.PR03: Default Settings - Password Rule Settings - Enforce custom list.
ID EIDSCA.PR03
Severity Medium
Suite EIDSCA
Product Entra ID
Feature Password protection
Security area Authentication
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:IA-5(1) Authenticator Management | Password-based Authentication
MITRE ATT&CK T1110
Reads from Microsoft Graph
Licence needed AAD_PREMIUM

What this checks and how to fix it

Section titled “What this checks and how to fix it”

When enabled, the words in the list below are used in the banned password system to prevent easy-to-guess passwords.

Password protection in Microsoft Entra ID - Microsoft Entra ID - Microsoft Learn

Test script

Section titled “Test script”
https://graph.microsoft.com/beta/settings
.values -eq 'True'
Section titled “Related links”

MITRE ATT&CK

Section titled “MITRE ATT&CK”
mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0006 - Credential Access - Credential Access
    (Mitigation)
      M1018 - User Account Management
      M1027 - Password Policies
    (Technique)
      T1110 - Brute Force
Tactic Technique Mitigation
TA0006 - Credential Access - Credential Access T1110 - Brute Force M1018 - User Account Management
M1027 - Password Policies

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.