AZ-104
Deep Dive
Policies, SSPR, hybrid writeback, and protection against weak passwords. The AZ-104 tests SSPR configuration, password writeback, and smart lockout.
Contents
Default policy — cloud users
Policy for synced users (AD DS)
Users synced from on-premises AD DS inherit the AD DS domain's password policy, not the Entra ID one.
• The password is managed in AD DS (ADUC or group policies)
• Entra ID cannot impose its expiration policy on synced users
• For the user to change their cloud password → needs Password Writeback
• Fine-Grained Password Policies in AD DS for specific groups
Entra ID → Password reset. Lets users reset their password without helpdesk intervention.
Properties
SSPR enabled
None / Selected / All
Group (if Selected)
Security group that can use SSPR
Authentication methods
Methods that can be enabled:
Email (external)
Mobile phone (SMS)
Office phone
Security questions
Mobile app code (TOTP)
Mobile app notification
Number required: 1 or 2. With 2 methods required, the user needs to verify with 2 distinct factors.
Registration + Notifications
Registration
Require registration on sign-in: Yes/No. Days before re-confirm: 0–730. If 0 = never re-confirm.
Notifications
Notify users on password reset: email to the user. Notify all admins when admin resets: alert to all admins (admins only).
Customization
Custom helpdesk link on the SSPR screen (e.g., link to the ticketing system).
Without writeback, SSPR only resets the cloud password. With writeback, the reset propagates to on-premises AD DS.
Requirements
Password writeback flow
Additional writeback options
Allow users to unlock without reset
The user can unlock their AD DS account without changing their password.
On-premises: Required by policy
Entra ID validates that the new password meets the AD DS policy BEFORE completing the process.
Writeback via Entra Connect Cloud Sync
New option: use Entra Connect Cloud Sync (lightweight agent) instead of classic Entra Connect.
Entra ID intelligently detects and blocks brute-force attempts without locking out legitimate users.
How Smart Lockout works
Default threshold: 10 failed attempts → account locked for 60 seconds. The time increases exponentially on successive lockouts.
Two instances: Smart Lockout keeps separate counters for familiar IPs (usual) vs unfamiliar IPs. An attacker from a new IP doesn't affect the counter for the user's usual IP.
Configurable: Entra ID → Security → Authentication methods → Password protection → Lockout threshold and Lockout duration.
For hybrid: Entra ID's Smart Lockout policy applies to Entra ID. On-premises AD DS has its own Account Lockout Policy. To synchronize them, you use the Entra Password Protection agent on the DCs.
Entra ID Password Protection
A service that enforces banned password lists both in Entra ID and in on-premises AD DS (via an agent installed on DCs).
Global banned list: Microsoft maintains a list of known compromised passwords. Updated continuously. Not configurable.
Custom banned list: The admin adds company-specific terms (company name, brand, HQ city).
Fuzzy matching: "P@ssw0rd" is also blocked if "password" is on the list. Variations with common substitutions (@ for a, 0 for o).
Configuration
Entra ID → Security → Authentication methods → Password protection → Custom banned passwords.
Enforce custom list: Yes/No.
Custom banned password list: One word per line. Maximum 1,000 terms. Minimum 4 characters each.
Typical examples: company name, city, flagship product, industry terms.
For on-premises (Password Protection Agent)
1. Install AzureADPasswordProtectionDCAgent.msi on every DC
2. Install AzureADPasswordProtectionProxy.msi on ≥2 servers for HA
3. Register the Proxy and DCs in Entra ID with Register-AzureADPasswordProtection*
4. The DCs download the banned lists from Entra ID via the Proxy (no direct DC→internet connectivity)
5. Runs in Audit mode first to see the impact before switching to Enforced
What exactly gets synced?
PHS does NOT sync the plaintext password or the NTLM hash directly. It syncs:
Sync process:
1. AD DS has the MD4 (NTLM) hash of the password
2. Entra Connect computes: PBKDF2(HMAC-SHA256, salted(MD4(password)), 1000 iterations)
3. That derived hash (16 bytes) is sent encrypted (TLS 1.2+) to Entra ID
4. Entra ID stores an additional hashed version for validation
The original AD DS hash never leaves the DC. Entra ID cannot reverse the process to recover the original password.
Sync cycle: When the user changes their password in AD DS, Entra Connect detects it and syncs it within ~2 minutes.
PHS also enables: Leaked credential detection
With PHS active, Identity Protection (P2) can compare the hashes against databases of compromised credentials (dark web) and generate "Leaked credentials" alerts for affected users.
Unlike classic Entra Connect, Cloud Sync configures writeback from the Azure portal without touching the agent server.
Configuration differences
| Aspect | Classic Connect | Cloud Sync |
|---|---|---|
| Configuration | Wizard on the server | Entra ID portal (cloud) |
| Staging server | Needed for HA | Multiple agents = automatic HA |
| On-demand test | Full sync cycle | On-demand provisioning per user |
| Writeback scope | All synced users | Configurable per OU or group |
Configuring writeback in Cloud Sync
Entra ID logs all authentication and password management activity. SSPR reports are especially useful for measuring adoption and detecting issues.
SSPR-specific reports
Password reset activity
Entra ID → Monitoring → Usage & insights → Authentication methods
How many resets occurred, how many completed vs failed, by method used, by user.
Password reset registration
Entra ID → Monitoring → Usage & insights → Authentication methods → Registration
What percentage of users have SSPR registered, which methods they have registered.
Authentication methods activity
Entra ID → Protection → Authentication methods → Activity
Adoption of each method (Authenticator app, SMS, FIDO2, etc.) for MFA and SSPR.
Log retention and export
| Log type | Free | P1/P2 |
|---|---|---|
| Sign-in logs | 7 days | 30 days |
| Audit logs | 7 days | 30 days |
| Risky sign-ins | No | 30 days |
| Risky users | No | 30 days |
Long retention → export to:
• Log Analytics Workspace — KQL queries, retention up to 2 years
• Azure Storage — cheap archiving, indefinite retention
• Azure Event Hubs — streaming to a SIEM (Sentinel, Splunk, QRadar)
Key events in the Audit Log for SSPR
Did you get this topic?
Test what you just learned
Which Microsoft Entra ID feature lets users reset their own password without IT team intervention?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.