Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Azure AD Password Protection (now part of Microsoft Entra ID) maintains a global banned password list and lets administrators add custom banned words such as company names. The feature can be enforced in the cloud immediately and, by installing the proxy and DC agents, can also evaluate password changes performed on-premises domain controllers. Conditional Access controls sign-in sessions, not password content. Password hash synchronization only copies password hashes to Microsoft Entra ID and does not evaluate password strength. Microsoft Entra Privileged Identity Management governs privileged role assignments rather than password creation.