Azure passowrd protection

If a banned password is still accepted, it typically indicates one of these conditions:

1. The DC Agent has not yet downloaded the latest policy version.
2. The Password Protection Proxy has not synchronized the updated banned word list with Azure.
3. The password passed the strength scoring algorithm — the banned word list is only one part of the evaluation, not the sole blocker.

Check the Domain Controller logs under:

Event Viewer → Applications and Services Logs → Microsoft → AzureADPasswordProtection → Admin

This log will show:

• Which policy version is being enforced.
• Whether the banned word list contains the word you tested.
• Whether the password was blocked or allowed and why.

If the policy version is outdated, force a policy refresh or restart the Proxy service.