I recently wrote this blog with instructions on how to load the top 1000 breached passwords into Azure AD to prevent users from selecting passwords in known breaches. It is simple to do and can be very effective.
here is the blog link which shows how to download the data from the NCSC (the national cybersecurity centre in the UK)
https://www.richardharpur.com/2019/06/11/configure-ncsc-top-passwords-list-in-azure-ad
