How Azure AD Password Protection Handles Spaces in Banned Words
Question details
The user needs to understand why Azure AD Password Protection detects and blocks a repeated banned word when typed without spaces, but fails to generate an audit event when the same banned phrase is separated by spaces.
- Product
- Microsoft Azure AD
- Device & OS
- not provided
- Scenario
- Testing or auditing custom banned password lists to ensure secure authentication policies.
- Observed behavior
- The system successfully catches the continuous banned word but does not reach the audit threshold when spaces are introduced between the words.
Ensure you have Global Administrator or Authentication Policy Administrator privileges in your Azure tenant to review custom banned password lists and proxy configurations.
Review Password Tokenization and Banned Word Synchronization
Understand the Azure AD scoring algorithm and verify that your custom banned password list is properly synchronized.
Azure AD Password Protection uses a complex scoring algorithm rather than simple exact-match text comparisons. When spaces or other separators are introduced into a password, the tokenization process changes.
This shift in tokenization can lower the resulting risk score of the password. If the calculated score does not reach the required minimum threshold, an audit or block event will not be generated, even if parts of the password are on the banned list.
Sign in to the Azure portal and navigate to Azure Active Directory (Microsoft Entra ID) > Security > Authentication methods > Password protection.
Check your 'Custom banned passwords' list. To explicitly prevent specific spaced phrases, add those exact spaced variations to the list to increase their penalty score.
Check the Event Viewer logs on your on-premises domain controllers (Event ID 30006) to confirm that the DC agents are successfully downloading the latest cloud policies.
Use the audit mode to test various password combinations with and without spaces to see how the scoring algorithm evaluates them before enforcing strict blocks.
Consult Microsoft Azure Support or Community Experts
If the tokenization behavior does not meet your specific security compliance requirements, reach out for specialized tenant-level analysis.
Discover a Lightweight Office Alternative with High Compatibility
While you are managing network security and Azure AD policies, having a reliable and secure office suite for your documentation and administrative tasks is essential. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office.
- 1. Download the Installer: Visit the official WPS Office website and click 'Download WPS Office Free'.
- 2. Install the Software: Run the lightweight installer and follow the on-screen prompts to complete the setup.
- 3. Open Your Documents: Launch WPS Writer, Spreadsheet, or Presentation to immediately begin working on your Microsoft Office files without any formatting loss.
Frequently Asked Questions
Why doesn't Azure AD Password Protection block exact banned words when spaces are added?
Azure AD Password Protection relies on a tokenization and scoring algorithm rather than simple text matching. Adding spaces alters how the password string is broken down (tokenized), which can lower its overall risk score below the threshold required to trigger an audit or block event.
Can I force Azure AD to block banned words containing spaces?
You cannot easily force the algorithm to treat spaced words identically to continuous words. However, you can add specific spaced variations of a word directly to your custom banned password list in the Azure portal to artificially increase their penalty score.
How do I know if my custom banned passwords are synchronized to local Domain Controllers?
You can verify policy synchronization by checking the Azure AD Password Protection DC agent Event Viewer logs on your domain controllers. Look specifically for event ID 30006, which indicates a successful password policy download from Azure.
