Password Protection and Authentication Troubleshooting

Stopping weak passwords at the source

Microsoft Entra Password Protection

How the evaluation works

When a user sets or changes a password, Password Protection:

1. Normalises the password — converts to lowercase, substitutes common replacements (@ → a, 0 → o, $ → s, etc.)
2. Checks against the global banned list — thousands of known weak passwords
3. Checks against your custom banned list — your organisation-specific terms
4. Applies fuzzy matching — catches variations within edit distance of banned terms
5. Scores the password — each unique token scores a point; needs 5+ points to pass

Custom banned password list

Elena adds these terms for MedGuard Health:

Banned Term	What It Catches
medguard	MedGuard1!, M3dgu@rd2024, MedGuardHealth
patient	Patient123, p@tient!, PatientData2025
auckland	Auckland2024, @uckl@nd!, AucklandNZ
health	Health123!, H3@lth2025 (already on global list variants)

On-premises deployment

For hybrid environments, Password Protection extends to on-prem AD:

1. Install the Proxy service — on a domain-joined server with internet access
2. Install the DC Agent — on every domain controller
3. Configure mode — Audit (log but don’t block) or Enforce (block weak passwords)

💡 Exam tip: Audit mode first

Always deploy Password Protection in Audit mode first. This logs which passwords would be rejected without actually blocking them. After reviewing the audit data (how many users would be affected, which passwords are weak), switch to Enforce mode.

The exam may ask: “Dev deploys Password Protection for a new client. Users report they can’t change their passwords. What went wrong?” → Check if Enforce mode was enabled without an audit period. Users may be trying common patterns that are now blocked.

Authentication troubleshooting

The sign-in logs — your primary tool

Entra admin center > Monitoring > Sign-in logs shows every authentication attempt with:

Column	What It Tells You
User	Who tried to sign in
Application	Which app they were accessing
Status	Success or failure (with error code)
Conditional Access	Which CA policies were evaluated and their result
MFA	Whether MFA was required and how it was satisfied
Location	IP address and geographic location
Device	OS, browser, compliance status
Risk	Sign-in risk level (none, low, medium, high)

Common authentication errors

Error Code	Meaning	Common Fix
AADSTS50126	Invalid username or password	Verify credentials, check password sync status
AADSTS50076	MFA required	User must complete MFA (check if method is registered)
AADSTS53003	Blocked by Conditional Access	Review CA policy — user/device doesn’t meet conditions
AADSTS50105	User not assigned to application	Assign the user to the enterprise application
AADSTS700016	Application not found	Verify app registration and tenant
AADSTS50059	No tenant information in request	Check sign-in URL includes tenant context

Dev’s troubleshooting methodology

When a client’s user reports “I can’t sign in,” Dev follows this systematic approach:

1. Check sign-in logs — find the specific failed attempt, note the error code
2. Check Conditional Access — was a CA policy blocking access? (most common cause at enterprise level)
3. Check MFA status — is the user registered for MFA? Did the MFA attempt fail?
4. Check account status — is the account enabled? Is it locked? Is the password expired?
5. Check sync status — for hybrid users, is the account properly synced? Password hash up to date?
6. Check application assignment — is the user assigned to the enterprise app they’re trying to access?

ℹ️ Deep dive: Conditional Access troubleshooting with What If

The What If tool in Conditional Access lets you simulate a sign-in scenario:

• Select a user, application, device platform, location, and risk level
• The tool shows which CA policies would apply and their outcome (grant, block, MFA required)
• This is invaluable for diagnosing “why can’t user X access app Y?”

Access: Entra admin center > Protection > Conditional Access > What If

The exam loves the What If tool. If a question asks “How should Elena determine which CA policy is blocking a user?” → Use the What If tool to simulate the scenario.

Key concepts to remember

Question

What two lists does Microsoft Entra Password Protection check against?

Click or press Enter to reveal answer

Answer

1. The global banned password list (maintained by Microsoft from real attack data, not configurable). 2. Your custom banned password list (up to 1,000 terms you define — company name, product names, etc.). Password Protection normalises input to catch common substitutions.

Click to flip back

Question

What is the AADSTS53003 error and how do you troubleshoot it?

Click or press Enter to reveal answer

Answer

AADSTS53003 means the sign-in was blocked by a Conditional Access policy. Troubleshoot by: 1. Check the sign-in log for which CA policy blocked access. 2. Use the What If tool to simulate the scenario. 3. Review the policy conditions — the user/device likely doesn't meet a grant control (MFA, compliant device, etc.).

Click to flip back

Question

What tool lets you simulate a sign-in scenario against Conditional Access policies?

Click or press Enter to reveal answer

Answer

The What If tool in Conditional Access (Entra admin center > Protection > Conditional Access > What If). Select a user, app, device, location, and risk level to see which policies would apply and their outcome.

Click to flip back

Knowledge check

Knowledge Check

Dev's client has deployed Microsoft Entra Password Protection in Enforce mode. A user tries to change their password to 'NimbleCloud2026!' and it's rejected. The user complains that the password meets complexity requirements. Why was it rejected?

AThe password is too short for the organisation's policyBPassword Protection detected 'nimblecloud' as a banned term on the custom list and rejected variationsCEnforce mode rejects all password changes regardless of qualityDThe user's account is locked and password changes are blocked

Check Answer

Knowledge Check

A MedGuard Health nurse reports she can't access a clinical application from her personal phone. Elena checks the sign-in logs and sees error AADSTS53003. What should Elena do next?

AReset the nurse's password and try againBCheck which Conditional Access policy blocked the sign-in and review its device compliance conditionsCDisable Microsoft Entra Password Protection for the nurse's accountDAssign an additional Microsoft 365 licence to the nurse

Check Answer

🎬 Video coming soon

---

Next up: Entra Identity Protection and Risk Policies — detecting risky sign-ins and compromised accounts automatically.