Password Protection, Windows Hello and Hybrid Authentication

What it is

Even with strong methods, passwords still exist, so Microsoft Entra offers ways to make them harder to guess. Password protection blocks weak passwords and smart lockout slows guessing. Windows Hello for Business replaces the password on Windows devices. For hybrid environments, Kerberos support lets cloud sign in unlock on premises resources.

How it works

Microsoft Entra password protection

Password protection checks every password change and reset against lists of banned passwords.

• The global banned password list is maintained by Microsoft from real attacks, and applies automatically to all tenants.
• A custom banned password list lets you add up to 1,000 terms of your own, such as the company name, product names or the city. Variations such as substituting characters are also caught. It needs Entra ID P1.
• Password protection for Windows Server Active Directory extends the same lists to on premises password changes, using a proxy service and an agent on each domain controller.

Entra ID also uses a scoring approach, so a password can be rejected even if it looks complex, for example Contoso2026! when Contoso is on the custom list.

Smart lockout

Smart lockout locks an account out after repeated failed sign in attempts, and it tries to tell the real user from an attacker by tracking familiar and unfamiliar locations.

You can change both values with Entra ID P1. A genuine user in a familiar location is not locked out by an attacker's guesses from another place. If a user chooses "I forgot my password" during SSPR, the lockout resets.

Windows Hello for Business

Windows Hello for Business replaces a password with a PIN or biometric gesture tied to the device and protected by a key, often in a TPM. The user unlocks the key locally, so no password crosses the network. In a hybrid environment there are three trust models for reaching on premises resources.

Microsoft Entra Kerberos for hybrid identities

Microsoft Entra Kerberos lets users who sign in to Entra with a passwordless method, such as Windows Hello for Business or a FIDO2 key, get a Kerberos ticket for on premises Active Directory resources. A server object, named AzureADKerberos, is created in Active Directory to issue partial tickets, and domain controllers complete them. This makes passwordless sign in work with file shares and on premises apps.

Disable accounts and revoke sessions

When an account is compromised, or an employee leaves:

1. Disable the account, so no new sign in succeeds.
2. Revoke user sessions, which invalidates refresh tokens so existing sessions end and the user must sign in again.
3. For synchronised accounts, the disable must be done in the source or the change is overwritten, and password reset in the right place.

In PowerShell, Revoke-MgUserSignInSession revokes a user's sessions. Continuous access evaluation ends access to some services within minutes after such an event.

Choosing the control

A worked scenario

A manufacturer has an on premises Active Directory and has deployed Windows Hello for Business to its laptops with cloud Kerberos trust, so no certificate infrastructure was needed. Staff sign in with a PIN, and still open file shares through Entra Kerberos. The security team adds its brand and product names to the custom banned password list and extends the check to on premises passwords with the on premises agent. When an employee's account is suspected of compromise, the help desk disables it, revokes the sessions and forces a password reset.